Thanks for the update. Are you going to rerelease the update with a valid certificate, or at least publish the SHA256 hash for the file so that we can verify that it downloaded correctly?
Yes, a new release is in progress already.
I came to the conclusion that a new release isn't warranted, as there are no code changes, or any changes to the package contents at all; instead I have manually signed the original installers on the build server, and then re-pushed to the download site.
Apologies for any inconvenience.
Thanks again,
rik.
On Fri, Sep 18, 2020 at 4:45 AM Dave Page <dpage@pgadmin.org> wrote:
Hi
On Thu, Sep 17, 2020 at 4:22 PM Dave Page <dpage@pgadmin.org> wrote:
Just downloaded pgadmin4-4.26-x64.exe from the official web site. When I go to install it comes up with an "unknown publisher".
Is this legit?
I'm seeing that too - there doesn't seem to be a digital signature on the installer.
So to the original question, yes, it is legit. The certificate expired :-(
I have to wonder a) how that happened without the build failing,
That happened because all our build scripts will ignore certificate not found type errors, throwing out a warning to the (very long) build log instead. Microsoft's tools don't give a separate error for expired certificates - they have a generic "No suitable certificate found" one.
It does it that way because individual developers don't have code signing certificates (they're expensive, a pain to get, and we don't want random ones with our name on them in existence, or to have lots of people with access to the one we use). Obviously the developers need to be able to build, even though they don't have a CSC.
