Pale Moon x86-64 SSE2/AVX2

[Kand_in_Sky]

Will this project continue after PM v33.3.0 (2024-08-13) now req. AVX?

[Pentium4User]

Will this project continue after PM v33.3.0 (2024-08-13) now req. AVX?

AVX2 will continue and SSE2 too.
The main will switch to AVX and nuck will build SSE2 and AVX2 according to what I read.

[Moonchild]

I can confirm that that is the plan.

[Nuck-TH]

As i finally sorted out issues with setting up Oracle Linux 8, found strength to make changes in configs and what(and how) exactly to change, builds of 33.3 are ready at last.

• From this version and forward i do SSE2 and AVX2 buils, because mainline took over AVX build.
• (Important) If your CPU doesn't support AVX instruction set and you used mainline build - you must manually migrate to SSE2 build from here. Reverse also applies: if you used AVX build - you should migrate to mainline build.

[Moonchild]

Thank you. I've updated the contributed builds page accordingly.

[ron_1]

When I click on the link on the contributed builds page, it just sends me back to this thread. Am I missing something?

EDIT
Okay, so I found the link on the first post of this thread. But shouldn't the link on the contributed build page send me to the same place instead of back to this thread?

[Mike_Walsh]

@ Nuck-TH :-

Excellent work, young sir. Thank you SO much for these.

Currently under test, in the re-packaged Puppy-'portable' format I produce for our wee community. To date, seems very stable. I've asked the community to report back any "instabilities" they may find to the portable Pale Moon thread on the Puppy Forum, and I'll forward these on to you.

Appreciated. Cheers!

Mike.

[ron_1]

So how do you verify the download? I looked at the file palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig but I have no idea how to verify it by that. I was expecting sha-256 sums.

[RealityRipple]

So how do you verify the download? I looked at the file palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig but I have no idea how to verify it by that. I was expecting sha-256 sums.

There's not really a fantastically easy way to do this, to my knowledge.

The way I do it is with Kleopatra. I think just about every linux distro has a kleopatra package in their mains. For anyone reading this on Windows, GPG4Win has everything you need.
Then you need Nuck-TH's public key, which was posted on the previous page, 7th post down in a hidden code block. The first time around, you have to:
- Import the public key (there's a menu item for importing a copied certificate in Tools -> Clipboard)
- Certify that you trust the imported key
And once that's done, you can basically just double-click the sig file and the rest is automatic.

I think you might have to create your own certificate in order to certify that you trust another, though. And if you're not using it for anything important other than this purpose, you can probably make one without an expiration date, just to make things easier on yourself. Kleopatra can help you create a new personal OpenPGP key pair pretty easily; I think it might even try to walk you through doing so when you first run it.

[back2themoon]

Thanks again, Nuck-TH. SSE2 is a lifesaver for now.

[karlchen]

Hi, Nuck-TH.

Another thank you by the owner of a very old machine, (CPU supports SSE2, but not AVX), running on Linux Mint 21.3 (base: Ubuntu 22.04)
and Pale Moon 33.3.0 (Package palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz)

Karl

[Moonchild]

There's not really a fantastically easy way to do this, to my knowledge.

Actually... with gpg4win installed, verifying a signature is as simple as having the .sig and binary in the same folder and double-clicking on the .sig file, which will launch kleopatra and do a verification. If the public key is uploaded to a keyserver, even the importing of that key will be automatic if it's not in the local keyring yet.

Not sure how difficult it is in comparison on Linux, but it's fairly painless on Windows.

[karlchen]

Not sure how difficult it is in comparison on Linux, but it's fairly painless on Windows.

gpg is needed. It comes pre-installed on any decent Linux release.

In a terminal window, you execute:

Code: Select all

$ # change to the directory where you have downloaded the Pale Moon installation package and the signature file to
$ # save the public key from the previous thread page here, too, named e.g. palemoon_pubkey.gpg
$ cd ~/Downloads/PaleMoon 

$ # directory content
karl@unimatrix0:~/Downloads/PaleMoon$ ls -l
-rw-rw-r-- 1 karl karl 36011388 Aug 15 18:41  palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz
-rw-rw-r-- 1 karl karl      659 Aug 15 18:41  palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig
-rw-rw-r-- 1 karl karl     2451 Aug 15 18:55  palemoon_pubkey.gpg

$ # import the public key once
$ gpg --import palemoon_pubkey.gpg

$ # verify the .tar.xz package against the .sig singature file
$ gpg --verify palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz

Output:

Code: Select all

karl@unimatrix0:~/Downloads/PaleMoon$ gpg --verify palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz
gpg: Signature made Wed Aug 14 17:13:47 2024 CEST
gpg:                using RSA key 5061CC51C94306050CFA1FEE48FAD2907D84EDEB
gpg: Good signature from "Nuck-TH <**************@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5061 CC51 C943 0605 0CFA  1FEE 48FA D290 7D84 EDEB

Done

[ron_1]

gpg is needed. It comes pre-installed on any decent Linux release.

I tried your example and got nowhere pretty fast. I looked in synaptic and I have gpgv installed, but not gpg. Do I have to add gpg to gpgv?

Sha256 sums is so much easier.

[jobbautista9]

You should install gpg. gpgv is just too stripped-down to be useful. You will have to use the full version of gpg to even get gpgv to recognize NuckTH's signature anyway: https://blog.oddbit.com/post/2020-10-05 ... ning-gpgv/

[ron_1]

You should install gpg. gpgv is just too stripped-down to be useful.

I'll check it out tomorrow when I have more time.

[ron_1]

I just tried this after downloading gpg. I need simpler instructions because I'm still getting nowhere fast.

EDIT
Okay, I tried the instructions from here:
https://www.wikihow.com/Verify-a-GPG-Signature

And this is what I got:

Code: Select all

$ gpg --verify palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz
gpg: directory '/home/ron/.gnupg' created
gpg: keybox '/home/ron/.gnupg/pubring.kbx' created
gpg: Signature made Wed 14 Aug 2024 11:13:47 AM EDT
gpg:                using RSA key 5061CC51C94306050CFA1FEE48FAD2907D84EDEB
gpg: Can't check signature: No public key

[ron_1]

Okay, somehow I figured it out and got this (the same are karlchen):

Code: Select all

$ gpg --verify palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz.sig palemoon-33.3.0.linux-x86_64-sse2_gtk2.tar.xz
gpg: Signature made Wed 14 Aug 2024 11:13:47 AM EDT
gpg:                using RSA key 5061CC51C94306050CFA1FEE48FAD2907D84EDEB
gpg: Good signature from "Nuck-TH <**************@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5061 CC51 C943 0605 0CFA  1FEE 48FA D290 7D84 EDEB

[Mike_Walsh]

Guys, perhaps a daft question, but.....wouldn't MD5 be easier? AFAIK, md5sum comes preinstalled on every Linux distro I've ever tried. Even in Puppy, where it's just one component of the Busybox multi-call binary that Puppy uses.

Or is MD5 not considered to be secure ENOUGH these days? I'm genuinely curious here, because I've had very little experience with most of these verification tools over the years. I've never been in the habit of verifying every last little item before I dare to use it To date, after 10 years with 'our Pup' I have never yet had a single dodgy download. Perhaps I've been fantastically lucky.....or maybe the Puppy model - that allows a session to disappear into cyberspace IF you think you've been compromised - has made me lazy.

That's MY situation. I provide checksums for every item I upload for the community, because people seem to want them.....but I never bother with them myself.

(*shrug...*)


Mike.

[ron_1]

Or is MD5 not considered to be secure ENOUGH these days?

I think SHA-256 sums are more secure than MD5. But I'm fine the way Nuck-TH does it now that I got it figured out.

BTW, I assume the line that reads gpg: WARNING: This key is not certified with a trusted signature! is nothing to worry about?