Tracking issue for new releases

[dennisameling]

Comments will be posted automatically here when a new release is made 🚀 If you have any questions about a specific release, either comment here or create a new issue.

[dennisameling]

This is an automated message that version 5.9.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.9.0-multi-arch

[c-a-m-a-c]

Thanks for creating a dedicated issue for the topic.

(v.5.9.0 files are submitted to Microsoft Security Intelligence for analysis/clearance by Microsoft Defender SmartScreen services)

Since we need and keep repeating this process but don't achieve any sustainable progress I explicitly asked for more insights and help at Microsoft Security Intelligence (see text below). I wonder what they answer (if at all). If needed, I'll file a support case later.

Downloaded from: https://signal.dennisameling.com/dl/signal-desktop-unofficial-win-5.9.0-ia32.exe
Windows Defender (1.343.1035.0) scan did not report any threats.
I keep submitting new releases of this software ("official" unofficial Signal client for Windows on ARM64) because they keep being "blocked" by Microsoft Defender Smartscreen. Since several versions/weeks the files are signed by the developers certificate. We understand that the certificate as such does not establish trust and needs to earn reputation first. I expected this to happen after a few releases, it obviously has not. Can you give us a hint on what is the problem and what needs to be done to improve this situation? (We're not interested in EV certs because I believe only reputation can solve the problem at its core and not some CA business model.)

[c-a-m-a-c]

Sorry, forgot to update here: v.5.9.0 files have established reputation with Microsoft Defender SmartScreen services.

So far no update regarding the code signing certificate (other than "The signing certificate (thumbprint ACC6AAB42506DFBC0550415EF3C1216E625F9085) is still in the process of establishing reputation. Once it does, all applications that are signed with that certificate should have a warn-free experience from the start.").

[dennisameling]

This is an automated message that version 5.10.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.10.0-multi-arch

[c-a-m-a-c]

I still get 404s when trying to download the v5.10.0 release files?

Updating the desktop app worked flawlessly.

[dennisameling]

I still get 404s when trying to download the v5.10.0 release files?

Thanks for reporting that issue, just fixed it in 1f45083...38a3c03 for future releases. The release script was looking for 5 characters between v and multi-arch, but now that 5.10.0 has been released (which is basically 6 characters), that doesn't work anymore 😅 should've tackled that right at the beginning, sorry.

Just updated the URLs for the 5.10.0 release as well 👍🏼

So far no update regarding the code signing certificate

I think submitting those files, while I do really appreciate it, really leads to a dead end unless those files get hundreds or thousands of downloads, or we get an EV certificate. I don't think it's too much of an issue for now. Once users have Signal Desktop Unofficial installed, the updater will "just work" so they won't be bothered by security issues anymore.

[dennisameling]

This is an automated message that version 5.11.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.11.0-multi-arch

[dennisameling]

This is a heads-up that I was blocked on releasing new builds because of a new RingRTC version that broke Windows arm64 builds. In the meantime I've been able to identify the issue and the fix: signalapp/webrtc#54

Expect the latest 5.12.2 release in the coming hours 👍🏼

[dennisameling]

This is an automated message that version 5.12.2 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.12.2-multi-arch

[dennisameling]

This is an automated message that version 5.13.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.13.0-multi-arch

[c-a-m-a-c]

(Back from vacation in a region with not too much performing internet. Version 5.13.0 files are submitted to Microsoft Security Intelligence for analysis/clearance by Microsoft Defender SmartScreen services. Let's continue this, I don't mind - if we manage your code signing certificate to join the circle of trust that would still help, possibly also in other projects.)

[dennisameling]

Let's continue this, I don't mind - if we manage your code signing certificate to join the circle of trust that would still help, possibly also in other projects

Alright, thanks for your efforts! Appreciate it 👏🏼

[dennisameling]

This is an automated message that version 5.14.0 is now live. Please note that it might take 1-2 hours for the binaries to be uploaded to the server.

Release URL: https://github.com/dennisameling/Signal-Desktop/releases/tag/v5.14.0-multi-arch