0.8.10 not signed, and insecure checksum given in release

[VoidingWarranties]

Part of this has already been brought up in #2236, but I don't think the issue was sufficiently addressed.

I have two concerns:

1. For 0.8.10, MD5 checksums were listed for the prebuilt binaries instead of SHA256.
2. The 0.8.10 tag was not signed, when the previous 4 release tags have been signed.

Why the sudden discrepancy in the release process?

[evertonfraga]

@luclu can you change our build server to generate SHA256 checksums again?

[luclu]

@evertonfraga with pleasure, I will also update them for the geth bins as the sha256 checking routine has now been included for over 5 releases.
Could you please take a look at the signing, as I did that in a rush during the travis/upload issues?

[hwinkler]

Weird this hasn't been fixed yet. Nobody should install an unsigned binary, that's a bad habit to get into where valuable data is at stake. Can you please escalate? It would be good to see the signing become well established as part of your build process, and unquestioned.

[paulfreeman]

What is the status of this issue? Mac OSX version 8.10 has incorrect file name associated with MD5 checksum. Version for download is not named 'unsigned'' and downloaded version is actually signed.

[hwinkler]

Lack of response gives me an uncomfortable feeling about Ethereum processes.

[evertonfraga]

As promised, v0.8.10 tag is now signed and its corresponding builds have SHA-256 checksums.

https://github.com/ethereum/mist/releases/tag/v0.8.10

[evertonfraga]

@hwinkler we had a huge amount of issues opened in the last weeks, due to increasing attention drawn to ethereum. That slowed down our ability to cope with the issues, but we're working on this.

I am closing this, thanks.

[evertonfraga]

SHA-256 checksums are back on our build process: #2917

Also, they are listed on v0.9.0 release. Thanks.

[lock]

This thread has been automatically locked because it has not had recent activity. Please open a new issue for related bugs and link to relevant comments in this thread.