In order to submit a desktop application for the Windows 8 app store, you need to digitally sign any driver or .exe associated with the application. However, the application I was trying to submit contains several files that are redistributions of other companies' software, and some of these are not signed. My application was rejected on these grounds. Is it legal (or ethical) to sign other companies' work so that we can submit our application? I think it might be considered some form of false representation but I'm not sure.
Signing redistributed files
legal;ethics
I can only answer this question on an ethical basis. Whether my ethical viewpoint is reflected in law is totally outside of my domain of expertise. (Also, I don't know the ins-and-outs of Microsoft's signing practices, so please correct me if I say something that's inconsistent with MS's way of doing things.)Suppose you sign some file F (having some contents C) with a signing key K. The resulting file/signature pair [F, S(K,C)] says:The owner of key K hereby asserts that file F has contents C.Assuming you have the right to distribute the files unsigned, it would seem that you would also have the default right to distribute them with a signature. A signature is a purely programmatic cryptographic transformation of the file that carries the above assertion. (Saying that you can't cryptographically sign something is quite close to claiming you're not allowed to produce a hash of it.)Your signature doesn't assert that you're the author of the code, but rather it asserts that you are a point of trust in the distribution of the code. That's not being misleading; that's merely a perfectly accurate representation of what is happening. The end recipient must decide whether they trust code distributed by you. The identity of the original author isn't relevant for our trust model, because you are the last person that touched the code before it arrived at their computer.