Mist: 0.8.10 not signed, and insecure checksum given in release
Part of this has already been brought up in #2236, but I don't think the issue was sufficiently addressed.
I have two concerns:
- For 0.8.10, MD5 checksums were listed for the prebuilt binaries instead of SHA256.
- The 0.8.10 tag was not signed, when the previous 4 release tags have been signed.
Why the sudden discrepancy in the release process?
VoidingWarranties
All 9 comments
@luclu can you change our build server to generate SHA256 checksums again?
evertonfraga
on 16 May 2017
@evertonfraga with pleasure, I will also update them for the geth bins as the sha256 checking routine has now been included for over 5 releases.
Could you please take a look at the signing, as I did that in a rush during the travis/upload issues?
luclu
on 16 May 2017
Weird this hasn't been fixed yet. Nobody should install an unsigned binary, that's a bad habit to get into where valuable data is at stake. Can you please escalate? It would be good to see the signing become well established as part of your build process, and unquestioned.
hwinkler
on 24 May 2017
What is the status of this issue? Mac OSX version 8.10 has incorrect file name
paulfreeman
on 1 Jun 2017
Lack of response gives me an uncomfortable feeling about Ethereum processes.
hwinkler
on 6 Jun 2017
As promised, v0.8.10 tag is now signed and its corresponding builds have SHA-256 checksums.
evertonfraga
on 8 Jun 2017
@hwinkler we had a huge amount of issues opened in the last weeks, due to increasing attention drawn to ethereum. That slowed down our ability to cope with the issues, but we're working on this.
I am closing this, thanks.
evertonfraga
on 8 Jun 2017
SHA-256 checksums are back on our build process: https://github.com/ethereum/mist/pull/2917
Also, they are listed on v0.9.0 release. Thanks.
evertonfraga
on 10 Aug 2017
This thread has been automatically locked because it has not had recent activity. Please open a new issue for related bugs and link to relevant comments in this thread.
![lock[bot] picture](https://avatars.githubusercontent.com/in/6672?v=4&s=40)
lock[bot]
on 30 Mar 2018
Related issues
ibart7
路
6Comments
ihatecreatingaccounts
路
6Comments
brandoncurtis
路
4Comments
sluTTYusr
路
3Comments
Raindownchips
路
6Comments
Most helpful comment
Weird this hasn't been fixed yet. Nobody should install an unsigned binary, that's a bad habit to get into where valuable data is at stake. Can you please escalate? It would be good to see the signing become well established as part of your build process, and unquestioned.