search

dennisameling / Signal-Desktop

Signal — Private Messenger for Windows, Mac, and Linux
https://signal.org/download
GNU Affero General Public License v3.0
131 stars 5 forks source link

Tracking issue for new releases #4

Closed dennisameling closed 1 year ago

dennisameling commented 3 years ago

Comments will be posted automatically here when a new release is made 🚀 If you have any questions about a specific release, either comment here or create a new issue.

dennisameling commented 3 years ago

This is an automated message that version 5.9.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.9.0-multi-arch

c-a-m-a-c commented 3 years ago

Thanks for creating a dedicated issue for the topic.

(v.5.9.0 files are submitted to Microsoft Security Intelligence for analysis/clearance by Microsoft Defender SmartScreen services)

Since we need and keep repeating this process but don't achieve any sustainable progress I explicitly asked for more insights and help at Microsoft Security Intelligence (see text below). I wonder what they answer (if at all). If needed, I'll file a support case later.

Downloaded from: https://signal.dennisameling.com/dl/signal-desktop-unofficial-win-5.9.0-ia32.exe Windows Defender (1.343.1035.0) scan did not report any threats. I keep submitting new releases of this software ("official" unofficial Signal client for Windows on ARM64) because they keep being "blocked" by Microsoft Defender Smartscreen. Since several versions/weeks the files are signed by the developers certificate. We understand that the certificate as such does not establish trust and needs to earn reputation first. I expected this to happen after a few releases, it obviously has not. Can you give us a hint on what is the problem and what needs to be done to improve this situation? (We're not interested in EV certs because I believe only reputation can solve the problem at its core and not some CA business model.)

c-a-m-a-c commented 3 years ago

Sorry, forgot to update here: v.5.9.0 files have established reputation with Microsoft Defender SmartScreen services.

So far no update regarding the code signing certificate (other than "The signing certificate (thumbprint ACC6AAB42506DFBC0550415EF3C1216E625F9085) is still in the process of establishing reputation. Once it does, all applications that are signed with that certificate should have a warn-free experience from the start.").

dennisameling commented 3 years ago

This is an automated message that version 5.10.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.10.0-multi-arch

c-a-m-a-c commented 3 years ago

I still get 404s when trying to download the v5.10.0 release files?

Updating the desktop app worked flawlessly.

dennisameling commented 3 years ago

I still get 404s when trying to download the v5.10.0 release files?

Thanks for reporting that issue, just fixed it in https://github.com/dennisameling/Signal-Desktop/compare/1f45083688996f3f8dbb80deeedd0e2587209872...38a3c03d9e618895bef205db5c4e43e5ce2cffe9 for future releases. The release script was looking for 5 characters between v and multi-arch, but now that 5.10.0 has been released (which is basically 6 characters), that doesn't work anymore 😅 should've tackled that right at the beginning, sorry.

Just updated the URLs for the 5.10.0 release as well 👍🏼

So far no update regarding the code signing certificate

I think submitting those files, while I do really appreciate it, really leads to a dead end unless those files get hundreds or thousands of downloads, or we get an EV certificate. I don't think it's too much of an issue for now. Once users have Signal Desktop Unofficial installed, the updater will "just work" so they won't be bothered by security issues anymore.

dennisameling commented 3 years ago

This is an automated message that version 5.11.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.11.0-multi-arch

dennisameling commented 3 years ago

This is a heads-up that I was blocked on releasing new builds because of a new RingRTC version that broke Windows arm64 builds. In the meantime I've been able to identify the issue and the fix: https://github.com/signalapp/webrtc/pull/54

Expect the latest 5.12.2 release in the coming hours 👍🏼

dennisameling commented 3 years ago

This is an automated message that version 5.12.2 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.12.2-multi-arch

dennisameling commented 3 years ago

This is an automated message that version 5.13.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.13.0-multi-arch

c-a-m-a-c commented 3 years ago

(Back from vacation in a region with not too much performing internet. Version 5.13.0 files are submitted to Microsoft Security Intelligence for analysis/clearance by Microsoft Defender SmartScreen services. Let's continue this, I don't mind - if we manage your code signing certificate to join the circle of trust that would still help, possibly also in other projects.)

dennisameling commented 3 years ago

Let's continue this, I don't mind - if we manage your code signing certificate to join the circle of trust that would still help, possibly also in other projects

Alright, thanks for your efforts! Appreciate it 👏🏼

dennisameling commented 3 years ago

This is an automated message that version 5.14.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.14.0-multi-arch

c-a-m-a-c commented 3 years ago

(Version 5.14.0 files have been submitted to Microsoft Security Intelligence for analysis/clearance by Microsoft Defender SmartScreen services.)

dennisameling commented 3 years ago

This is an automated message that version 5.15.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.15.0-multi-arch

dennisameling commented 3 years ago

The Apple Silicon-runner we use is currently offline, so v5.15.0 is currently only available for Windows ia32 and arm64. Have informed the maintainer of the Apple Silicon machine and hope to have an update in the next 24 hours 👍🏼

dennisameling commented 3 years ago

Update: v5.15.0 is now available for Apple Silicon as well 🎉

dennisameling commented 3 years ago

This is an automated message that version 5.16.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.16.0-multi-arch

dennisameling commented 3 years ago

This is an automated message that version 5.17.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.17.0-multi-arch

ocsocs commented 3 years ago

The new version says it has expired and suggests a download of the x86-only Signal: expired How to fix? Thanks!

dennisameling commented 3 years ago

This is an automated message that version 5.17.2 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.17.2-multi-arch

dennisameling commented 3 years ago

@ocsocs sorry for the late reply. I missed the 5.17.1 release due to being super busy at work. You can now download the latest release here: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.17.2-multi-arch

ocsocs commented 3 years ago

There's no hurry at all, thanks a lot!

The bad news is the issue remains with 5.17.2 as well: still-bad

dennisameling commented 3 years ago

Hmm - interesting. I'm not seeing that here. I'm not sure how Signal checks if a build has expired - is your system time OK (date + time)? Just checking

ocsocs commented 3 years ago

Dennis,

On 17. 9. 2021, at 13:45, dennisameling @.***> wrote: Hmm - interesting. I'm not seeing that here. I'm not sure how Signal checks if a build has expired

Aha, that's bad news. Looks like I'll have to download the sources and check when I find a time for that :)

  • is your system time OK (date + time)? Just checking

Absolutely.

I've tried to get some logs, but looks like Signal does not log anything itself — best I've got are some Apple subsystem logs related to Signal, which seem good for nothing; attaching just in case.

Thanks and all the best, OC

ocsocs commented 3 years ago

Looks like the attachment did not make it through, sending again (though I am pretty sure it can't help any) signal.log

dennisameling commented 3 years ago

This is an automated message that version 5.18.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.18.0-multi-arch

tobiaskohlbau commented 3 years ago

This is an automated message that version 5.18.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: v5.18.0-multi-arch (release)

Please note that the Mac builds are not included as I'm guilty for turning off the hosted runner. It will be back on Monday or Tuesday, so the builds are following. I'm sorry!

dennisameling commented 3 years ago

This is an automated message that version 5.18.1 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.18.1-multi-arch

elvey commented 3 years ago

FYI, as of right now*, of these 3 URLs, only the first works:

https://signal.dennisameling.com/dl/signal-desktop-unofficial-mac-5.17.2-arm64.dmg https://signal.dennisameling.com/dl/signal-desktop-unofficial-mac-5.18.1-arm64.dmg https://signal.dennisameling.com/dl/signal-desktop-unofficial-mac-5.18.0-arm64.dmg

*[Edited: ~2 weeks] more than 1-2 hrs [Added: Oops? It seems I didn't grok @tobiaskohlbau's comment above addressed the ~2 week lag.]

Thanks though. I could (head to the forums and) read #5541 to better understand why Signal isn't releasing for ARM, AND closed https://github.com/signalapp/Signal-Desktop/issues/4461 and https://github.com/signalapp/Signal-Desktop/issues/3745; I see the latter is closed with: "Please discuss feature requests in community forums #5541." I GUESS the others not being available is why https://github.com/lockieluke/SignalArmInstaller uses 5.17.2. Thank you for your contributions, Dennis Ameling!

stefandesu commented 3 years ago

Official 5.19.0 just got released as well, so I guess there will be another update soon anyway.

Looking at https://github.com/lockieluke/SignalArmInstaller though, I would guess that they just used the latest version available at the time of writing the code.

dennisameling commented 3 years ago

This is an automated message that version 5.19.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.19.0-multi-arch

dennisameling commented 3 years ago

@elvey thanks for reaching out! You're right. Please see @tobiaskohlbau's comment above. We use his Mac Mini for Apple Silicon builds but it's offline, so GitHub Actions is waiting for an available Apple Silicon runner to start the build. I expect it to become available hopefully today or tomorrow - then the missing builds will be added by the CI pipeline.

dennisameling commented 3 years ago

Looking at https://github.com/lockieluke/SignalArmInstaller though, I would guess that they just used the latest version available at the time of writing the code.

@stefandesu looks like they did - you could create an issue or PR there to ask them to use the latest version instead. Information about the latest available version can be retrieved in two ways:

The first method is more accurate as it reflects the latest build that's actually on my server. The second one is a bit less reliable as there might be some time between creating the GitHub release and pushing the build to my server.

Hope this helps! 👍🏼

tobiaskohlbau commented 3 years ago

This is an automated message that version 5.19.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: v5.19.0-multi-arch (release)

This build should now be available for macOS arm64 (Apple Silicon).

dennisameling commented 2 years ago

This is an automated message that version 5.20.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.20.0-multi-arch

dennisameling commented 2 years ago

This is an automated message that version 5.21.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.21.0-multi-arch

dennisameling commented 2 years ago

This is an automated message that version 5.22.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.22.0-multi-arch

dennisameling commented 2 years ago

This is an automated message that version 5.23.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.23.0-multi-arch

dennisameling commented 2 years ago

This is an automated message that version 5.23.1 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.23.1-multi-arch

tobiaskohlbau commented 2 years ago

This is an automated message that version 5.23.1 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: v5.23.1-multi-arch (release)

Just again a small notice that I've updated the Mac builder and it's currently offline. Expect a build to appear this evening (CET).

tobiaskohlbau commented 2 years ago

This is a notification to let everyone know that the M1 builds are up.

dennisameling commented 2 years ago

This is an automated message that version 5.24.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.24.0-multi-arch

dennisameling commented 2 years ago

This is an automated message that version 5.25.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.25.0-multi-arch

dennisameling commented 2 years ago

Some great news: the Signal team upgraded NodeJS from v14 to v16 with the v5.25.0 release. They also upgraded node-sass from 4.14.1 to 6.0.1, which is a hard requirement for Windows ARM64 and Apple Silicon support 🚀

Next to that, the team removed the dependency on one of their native dependencies, zkgroup, and incorporated it into libsignal-client.

All this means that it's now less painful for me to update the fork (as it's closer to the official repo), and that the Signal team is one step closer to official Apple Silicon support (still curious when they will announce that...).

The most work for me to release new versions remains in the native dependencies:

I've automated the ringrtc and libsignal-node builds in https://github.com/dennisameling/signal-native-deps - luckily the Signal team doesn't update them with every release of Signal Desktop, and with this automation it's already a lot easier.

Here's to hoping the Signal team will start releasing official Apple Silicon (and Windows ARM64) builds soon :rocket:

For an overview of how my fork still differs from the official repo, please check this diff.

dennisameling commented 2 years ago

This is an automated message that version 5.25.1 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.25.1-multi-arch

c-a-m-a-c commented 2 years ago

@dennisameling, the executables for Windows are still being flagged by Microsoft Defender SmartScreen as not safe. Meanwhile, I report those via integrated feedback method ("Report this app as safe"):

However, it seems that this does not help :-(. Maybe it'd be more useful to use the other option. But that should be done by yourself, you'd then need to provide quite some additional details.

Again, thanks a lot for your work!!

dennisameling commented 2 years ago

@marcocastagna Thanks for reporting all of those downloads - appreciate your efforts. I already did that option a while ago and it didn't help at all, unfortunately. I think the only way to really get rid of these warnings is to get an EV certificate. My current (regular) certificate is valid until some time in May. Cheapest EV code signing certificate I could find so far is ~€300 excl VAT for 1 year 😅

I'll reach out to the Signal team in the coming days to see what their plans are with Windows ARM64 - if they'll support it soon then I won't put much effort into this anymore. To be continued!

dennisameling commented 2 years ago

This is an automated message that version 5.26.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.26.0-multi-arch

dennisameling commented 2 years ago

So Signal introduced a new native dependency in 5.26.0 (https://github.com/Automattic/node-canvas) which breaks all three builds in my fork (Apple Silicon, Windows x86, Windows arm64).