Emby qpkg with valid digital signature

[somy 25]

Hi,

QNAP started to strengthen security (at last) in their QTS since recent firmware, it is more and more necessary to get Emby installed with a valid digital signature. As an example, I have 2 medium risk security warnings due to lack of valid digital signature:

[Luke 42077]

 

[somy 25]

On 4/24/2021 at 3:24 AM, Luke said:

 

Hi @Luke, I'm not sure why Emby doesn't take this seriously. Without a valid signature, in theory someone can manipulate the app with malware etc. and distribute to your users, which will damage Emby's reputation. 

[Luke 42077]

Hi, we are taking it seriously. Thanks for the feedback.

[KellicTiger 0]

On 4/23/2021 at 8:24 PM, Luke said:

 

Hi Luke.  I respectfully disagree.  Plex's packages you download from the site have a valid signature.  At some point with all the security issues QNAP has been having over the last year they may require a valid signature even for apps loaded outside of their market.  It would be a good idea for Emby to get ahead of the curve so you aren't scrambling to get one.  Note that the below screenshot shows a Plex app downloaded from their site, not from QNAP's market.


 

[Luke 42077]

15 hours ago, KellicTiger said:

Hi Luke.  I respectfully disagree.  Plex's packages you download from the site have a valid signature.  At some point with all the security issues QNAP has been having over the last year they may require a valid signature even for apps loaded outside of their market.  It would be a good idea for Emby to get ahead of the curve so you aren't scrambling to get one.  Note that the below screenshot shows a Plex app downloaded from their site, not from QNAP's market.


 

Their package is also approved in the QNAP app store so that is the difference. There is currently no way to have a digital signature if you are not a QNAP approved app. We're doing the best we can with this given the cards dealt to us.

[somy 25]

12 hours ago, Luke said:

Their package is also approved in the QNAP app store so that is the difference. There is currently no way to have a digital signature if you are not a QNAP approved app. We're doing the best we can with this given the cards dealt to us.

I might be wrong on this, but I think it’s possible to publish your app with valid signature without QNAP App Store approval. For example every app I download from third party App Store (https://www.qnapclub.eu/en) has valid signature, I don’t think any of these apps is approved by qnap. 

[Luke 42077]

Qnap club has undocumented special permissions from QNAP to sign packages that are uploaded to them, so no, that's not something that a third party developer can replicate.

[somy 25]

2 minutes ago, Luke said:

Qnap club has undocumented special permissions from QNAP to sign packages that are uploaded to them, so no, that's not something that a third party developer can replicate.

Ok, I wasn’t aware of this. So what stops Emby to publish to qnap App Store? Was it due to the partnership qnap has with Plex? I know Emby is in synology App Store.

[zgoneq 0]

Hi,

any progress with digital signature? I have to update my qnap to version 5.0.0.1932, and i must everyday start emby server by hand. This is very uncomfortable.

[Luke 42077]

On 2/23/2022 at 1:45 PM, zgoneq said:

Hi,

any progress with digital signature? I have to update my qnap to version 5.0.0.1932, and i must everyday start emby server by hand. This is very uncomfortable.

@zgoneq the workaround is to enable this option in QTS: 

 

Thanks.

[zgoneq 0]

thans, it works

(for now)

[Chase1701 0]

Ok So it is 2022 and yet no digital signature for QNAP!

 

Is there going to be a solution??

[Luke 42077]

On 8/4/2022 at 1:59 PM, Chase1701 said:

Ok So it is 2022 and yet no digital signature for QNAP!

 

Is there going to be a solution??

Hi, we're hopeful, but in the meantime, there is still a way to install Emby Server for QNAP:

https://emby.media/qnap-server.html

[embyL0VER 71]

Hi there,

just want to bring this up again cause after updating to the latest firmware (5.0.1.2145) from Qnap, the setting for allowing app installation without digital signatures is again disabled by default. Yes we can still enable this option again but there were other third party apps out now that have a valid signature even if they were not approved from qnap or qnapclub.

So just asking if emby will also get a valid one in the future? 

[Luke 42077]

10 minutes ago, embyL0VER said:

Hi there,

just want to bring this up again cause after updating to the latest firmware (5.0.1.2145) from Qnap, the setting for allowing app installation without digital signatures is again disabled by default. Yes we can still enable this option again but there were other third party apps out now that have a valid signature even if they were not approved from qnap or qnapclub.

So just asking if emby will also get a valid one in the future? 

Hi, yes we will keep trying to get into the QNAP catalog just as we are on Synology, Asustor and others. Thanks.

[jhawkinsvalrico 0]

Sorry to say that while I purchased a license for Emby until the application is digitally signed I am removing it from my server.

[muppets4 24]

Yesterday there was a firmware update. After that, Emby server closes with the following error: "[App center] Emby Server has an invalid digital signature. The app has stopped and cannot be installed on QTS. You can remove it in the app center"

So I can't use Emby anymore. Are there plans for a quick update?

edit: I am on QTS 5.0.1.2145

Edited September 20, 2022 by muppets4

[Luke 42077]

7 hours ago, muppets4 said:

Yesterday there was a firmware update. After that, Emby server closes with the following error: "[App center] Emby Server has an invalid digital signature. The app has stopped and cannot be installed on QTS. You can remove it in the app center"

So I can't use Emby anymore. Are there plans for a quick update?

edit: I am on QTS 5.0.1.2145

Did you check your option in QNAP "Allow installation and execution of applications without a digital signature" ?