Windows installers do not have GPG or Authenticode signatures, SHA-512 not provided

eclipse / mosquitto

Eclipse Mosquitto - An open source MQTT broker

https://mosquitto.org

Other

8.64k stars 2.33k forks source link

Windows installers do not have GPG or Authenticode signatures, SHA-512 not provided #1001

Open kyanha opened 5 years ago

kyanha commented 5 years ago

Windows installers for Mosquitto 1.5.3 available from http://mosquitto.org/download/ are made available only over unencrypted http, are not signed with GPG or Authenticode signatures, and their SHA-512s are not made available either. There is no means of verifying the authenticity of this code that is demanding elevation to be able to install.

karlp commented 5 years ago

If this is a concern for you, I recommend building from the signed source.

ralight commented 5 years ago

The links for the downloads has been updated to https (they were always available on https by the way). The SHA512s are available on the download link already, you have to click the "SHA512" button.