Pale Moon 27.4.2 x86 installer - no digital signature

[Freezing Moon]

As the title says.

[Moonchild]

What do you mean? http://www.palemoon.org/pgp/palemoon-27 ... er.exe.sig is there.

[Freezing Moon]

27.4.1

http://imgur.com/a/aMIyB


27.4.2

http://imgur.com/a/oinAn

[Moonchild]

Aha, Okay. They aren't code-signed.
That was indeed a slip-up on my part -- if you want to verify the integrity, check the SHA posted on the website or use the PGP signatures, please.

I'll code-sign them and update later today.

[dark_moon]

Same for x64 version.

GPG sig and SHA2-256 checksum is fine.

[Freezing Moon]

Avast blocked installer (Cyber Capture) and sent the file to Avast Virus Lab.
Of course it is a FP.This is because of lack of digital signature.

This file can be dangerous :

http://imgur.com/a/HONqc

[Moonchild]

Yeah hold yer horses! I'm working on it, damnit.

[Moonchild]

Updated the installers with code-signed versions.

[Freezing Moon]

Thanks. Everything is fine now.
Cyber Capture was activated again. This time it was for setup.exe from Temp folder during installation, but I clicked on
'Run it anyway' or something like that.

[Freezing Moon]

Same thing with 27.6.1 x64 installer.

[Moonchild]

Same thing with 27.6.1 x64 installer.

Fixed. Sorry about that. 's what happens when you're chronically short on sleep leading up to a release.

[Moonchild]

As an aside, since StartCom has fallen out of grace by people, I'm not sure if I'll be able to get a new code signing certificate when the current one expires in January.
Does anyone know of affordable options for a FOSS project like ours?

[JustOff]

I don't know any cheaper options from trusted authorities than $85/year form Comodo. Centrum used to be free for OSS, now they offer €86/1st year + €28/renewal, but it looks somehow questionable.

[Moonchild]

I've been in contact with Comodo and after payment it boiled down to them not actually doing IV certificates and requiring a registered business. Any alternative that condenses down to the actual CA being Comodo won't work.

Maybe StartCOM will still work for code signing; after all, it's still a valid CA, just not trusted for "the web" because of arbitrary politics. I'll have to do some research.

EDIT: asked StartCOM, and no, they've been distrusted on all platforms, meaning code signing is also out.

[Moonchild]

I guess Certum is the only option. Now to wait for Comodo's refund so I can pay for it