Signature verification failing for 150.0.1-1 update

[narinishi]

Image attached showing further details

[ltguillaume]

Yep, this sucks. OSSign decided to change their certificate's subject name, which is checked by WinUpdater before installation. For more information, see https://codeberg.org/librewolf/winupdater/issues/71.

The latest release of WinUpdater will remedy this, but the old WinUpdater will not be able to recognize this new certificate name used to sign the new WinUpdater release, so you can click "Yes" once for the following message:

[exscape]

In addition to the main issue, the message needs work. There's no question anywhere, so it's not clear what "yes" means, nor what "no" means.

I assume the implicit question is whether you want to ignore the signature check and proceed anyway?

[ltguillaume]

I agree it might not be the best sentence.

I assume the implicit question is whether you want to ignore the signature check and proceed anyway?

Correct.

It says "click "Yes" to continue", so "No" will not continue the operation. After clicking "No", you'll see the error and you can restart or close WinUpdater, or go to WinUpdater's website to get more info.

[gravyproblem]

This is actually scary, how can we know the project hasn't been compromised?

[ltguillaume]

This is actually scary, how can we know the project hasn't been compromised?

https://codeberg.org/librewolf/winupdater/issues/71
and
https://reddit.com/r/LibreWolf/comments/1syuvpi/getting_this_error_while_updating_librewolf/oixhc95/?context=3#oixhc95

[crespire]

Is the Codeberg repo the canonical repository? If so, it would be nice to have that more prominently displayed in the Github readme. Currently, it's just the first link near the top.

[ltguillaume]

Is the Codeberg repo the canonical repository? If so, it would be nice to have that more prominently displayed in the Github readme. Currently, it's just the first link near the top.

That's a good point. I've added "Mirror of ..." at the beginning of the repo description, too.