Signed
Windows no longer shows "Unknown publisher". This build carries a Public Trust
Authenticode signature issued to the company.
Subject CN=Lueken Good Design LLC, O=Lueken Good Design LLC, S=Oregon, C=US
Issuer CN=Microsoft ID Verified CS EOC CA 03
Timestamped RFC3161, Microsoft Public RSA Time Stamping Authority
Check it yourself with no tools: right-click the installer, Properties, then
the Digital Signatures tab.
sha256 885214dc2eaaa17326792b8ff16f01022de3a6ceb7cfacbb1d0d2a5b33e93e32
That hash is a build fingerprint rather than a security claim; the signature is
the security claim. It is useful for confirming the file here and the one on
translocator.app are the same bytes, since those are two independent hosts.
Updating
On 0.3.0: the launcher updates itself. Nothing to do.
On 0.2.x: you need to install this one by hand, once. The updater signing
key was replaced in 0.3.0, so your launcher will offer the update and then fail
with "The signature was created with a different key than the one provided".
That is expected and nothing on your installation is touched. Download the
installer below and run it; updates work normally afterwards.
Also in this release
Nothing user-facing beyond the signature. Under the hood, the signing
configuration is kept out of the repository so that anyone can still build the
project without an Azure account, and docs/releasing.md records the setup
along with the three failure modes that cost the most time to diagnose.
The launcher is free software under GPL-3.0, and contributions are taken under a
Developer Certificate of Origin with no CLA and no copyright assignment. See
CONTRIBUTING.md.