Update Windows code signing certificate #22017

Updates the Windows code signing certificate to a new one issued by Digicert. This certificate has been issued to Bitcoin Core Code Signing LLC registered in Delaware, US. Note that this is different from the previous Bitcoin Core Code Signing Association registered in Zurich, Switzerland as it was unable to meet the validation requirements in time.

Needs backport to 0.21, 0.20, and 0.19.

Once this is merged into the previous branches, we should make 0.21.1.1, 0.21.0.1, 0.20.1.1, 0.20.0.1, and 0.19.2.1 releases as these are either unsigned or signed with the previous key which was revoked.

Is there a timeline on the Zurich alternative? We've been unable to sign Windows releases for a while, so unless it's a matter of days, I'm concept ACK on just going ahead with this.

These 0.*.*.1 releases would be windows-only? What is the point of v0.20.0.1? It seems better to just release v0.20.2 since the 0.20 branch has plenty of improvements since v0.20.1.

Is there a timeline on the Zurich alternative? We've been unable to sign Windows releases for a while, so unless it's a matter of days, I'm concept ACK on just going ahead with this.

There is no timeline. We're still waiting for the registration with the government to go through, but there's not ETA on when that will be. Then we'd have to wait a few more days for Digicert to issue the certificate.

These 0.*.*.1 releases would be windows-only?

Yes, Windows only.

What is the point of v0.20.0.1? It seems better to just release v0.20.2 since the 0.20 branch has plenty of improvements since v0.20.1.

The idea was that each release we have done previously which used the revoked cert should be re-released so that if people wanted to use them (and not a future minor release on the branch) they could. But perhaps that is not something we want to do.

But perhaps that is not something we want to do.

That seems a bit overkill.

Backported in #22022 (assuming the commit with that hash is merged into master)

utACK 167fb1f

I imported it in the macOS keychain manager and certificate looks sane to me: <img width="531" alt="Schermafbeelding 2021-05-22 om 13 54 40" src="https://user-images.githubusercontent.com/10217/119225660-51690600-bb05-11eb-9695-95fdcfc42283.png">

I guess the way to test this is with the GUIX build in #21239 or the upcoming Gitians builds.

This one year expiration is not an issue, as long as it's not revoked?

This one year expiration is not an issue, as long as it's not revoked?

Yes. CAs now only issue 1 year certs.

Is there a timeline on the Zurich alternative? We've been unable to sign Windows releases for a while, so unless it's a matter of days, I'm concept ACK on just going ahead with this.

It's hard to give an estimation right now. We are waiting for all the paperwork to complete and the stamp from the government so it will be listed in the official registers. Once there, we hopefully can get code signing certificates again.

ACK 167fb1fc72e309587a8ef1d7844cb51a5483f54f We can always switch the cert again if there's a different one we want to use.

The backport of this change was done for 0.20 in https://github.com/bitcoin/bitcoin/commit/55631547ea88847b6cdf3b4ef7c46525fde24d78 and 0.19 in https://github.com/bitcoin/bitcoin/commit/461b9b11b20a92a920a9ffee001b8694c122a4fa.