{"action":"created","issue":{"url":"https://api.github.com/repos/arduino/Arduino/issues/4552","repository_url":"https://api.github.com/repos/arduino/Arduino","labels_url":"https://api.github.com/repos/arduino/Arduino/issues/4552/labels{/name}","comments_url":"https://api.github.com/repos/arduino/Arduino/issues/4552/comments","events_url":"https://api.github.com/repos/arduino/Arduino/issues/4552/events","html_url":"https://github.com/arduino/Arduino/issues/4552","id":132575469,"number":4552,"title":"Windows installer will require updated SHA2 signature","user":{"login":"PaulStoffregen","id":965463,"avatar_url":"https://avatars.githubusercontent.com/u/965463?v=3","gravatar_id":"","url":"https://api.github.com/users/PaulStoffregen","html_url":"https://github.com/PaulStoffregen","followers_url":"https://api.github.com/users/PaulStoffregen/followers","following_url":"https://api.github.com/users/PaulStoffregen/following{/other_user}","gists_url":"https://api.github.com/users/PaulStoffregen/gists{/gist_id}","starred_url":"https://api.github.com/users/PaulStoffregen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PaulStoffregen/subscriptions","organizations_url":"https://api.github.com/users/PaulStoffregen/orgs","repos_url":"https://api.github.com/users/PaulStoffregen/repos","events_url":"https://api.github.com/users/PaulStoffregen/events{/privacy}","received_events_url":"https://api.github.com/users/PaulStoffregen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-10T00:19:42Z","updated_at":"2016-02-10T14:09:04Z","closed_at":null,"body":"The next release of Arduino will require updated SHA2 signing on Windows.\r\n\r\nFailure to update Arduino's code signing certificate and build process before release of Arduino 1.6.8 will result in Windows 7,8,10 users getting a red error message: signature of this file is corrupt or invalid.\r\n\r\nThe alarming messages are shown within Internet Explorer immediately after the download completes.\r\n\r\nHere is Microsoft's security advisory about this change.\r\n\r\nhttps://technet.microsoft.com/library/security/3123479\r\n\r\nPrograms built before Jan 1, 2016 are \"grandfathered\" until 2017 from this check, which is why Arduino 1.6.7 and prior releases have not yet experienced this problem.  Anything built after Jan 1, 2016 (according to the cryptographically certified timestamp) requires SHA2 to avoid these alarming messages.\r\n\r\nArduino needs to first get an updated code signing certificate.  The certificate used can be checked by right-clicking on the installer and choosing properties, then the Digital Signatures tab, then Details, then View View Certificate, and then the Details tab, which shows the certificate's signature algorithm.\r\n\r\n![sig1](https://cloud.githubusercontent.com/assets/965463/12935198/f84cb542-cf48-11e5-8c34-a5c4cf236a89.jpg)\r\n\r\nAfter you've got a certificate using SHA2, then you need to update Arduino's build process to generate a SHA2 signature.  The main properties dialog shows which algorithm you used to sign.\r\n\r\n![sig2](https://cloud.githubusercontent.com/assets/965463/12935201/004c519e-cf49-11e5-9c0b-2d28fd741abf.jpg)\r\n\r\nBoth your signature and the signature within your code signing certificate must be SHA2 to pass the new checks in Windows 7,8,10.\r\n\r\nI know this in unpleasant news.  But in case this wasn't already on your radar, it's far less painful to start the process of getting your code signing certificate re-issued and updating build settings *before* releasing an installer which alarms users with an invalid signature.\r\n\r\nMore info can be found here, and many other sites.\r\n\r\nhttp://support.ksoftware.net/support/solutions/articles/215805-the-truth-about-sha1-sha256-and-code-signing-certificates-\r\n\r\nhttps://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/1102/7/code-signing-certificates---sha1-and-sha-256-information\r\n"},"comment":{"url":"https://api.github.com/repos/arduino/Arduino/issues/comments/182390616","html_url":"https://github.com/arduino/Arduino/issues/4552#issuecomment-182390616","issue_url":"https://api.github.com/repos/arduino/Arduino/issues/4552","id":182390616,"user":{"login":"PaulStoffregen","id":965463,"avatar_url":"https://avatars.githubusercontent.com/u/965463?v=3","gravatar_id":"","url":"https://api.github.com/users/PaulStoffregen","html_url":"https://github.com/PaulStoffregen","followers_url":"https://api.github.com/users/PaulStoffregen/followers","following_url":"https://api.github.com/users/PaulStoffregen/following{/other_user}","gists_url":"https://api.github.com/users/PaulStoffregen/gists{/gist_id}","starred_url":"https://api.github.com/users/PaulStoffregen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PaulStoffregen/subscriptions","organizations_url":"https://api.github.com/users/PaulStoffregen/orgs","repos_url":"https://api.github.com/users/PaulStoffregen/repos","events_url":"https://api.github.com/users/PaulStoffregen/events{/privacy}","received_events_url":"https://api.github.com/users/PaulStoffregen/received_events","type":"User","site_admin":false},"created_at":"2016-02-10T14:09:04Z","updated_at":"2016-02-10T14:09:04Z","body":"![capture2](https://cloud.githubusercontent.com/assets/965463/12949462/c81e9f38-cfbc-11e5-8259-d18507be6b35.PNG)\r\n"}}