Windows installer will require updated SHA2 signature #4552
Description
The next release of Arduino will require updated SHA2 signing on Windows.
Failure to update Arduino's code signing certificate and build process before release of Arduino 1.6.8 will result in Windows 7,8,10 users getting a red error message: signature of this file is corrupt or invalid.
The alarming messages are shown within Internet Explorer immediately after the download completes.
Here is Microsoft's security advisory about this change.
https://technet.microsoft.com/library/security/3123479
Programs built before Jan 1, 2016 are "grandfathered" until 2017 from this check, which is why Arduino 1.6.7 and prior releases have not yet experienced this problem. Anything built after Jan 1, 2016 (according to the cryptographically certified timestamp) requires SHA2 to avoid these alarming messages.
Arduino needs to first get an updated code signing certificate. The certificate used can be checked by right-clicking on the installer and choosing properties, then the Digital Signatures tab, then Details, then View View Certificate, and then the Details tab, which shows the certificate's signature algorithm.
After you've got a certificate using SHA2, then you need to update Arduino's build process to generate a SHA2 signature. The main properties dialog shows which algorithm you used to sign.
Both your signature and the signature within your code signing certificate must be SHA2 to pass the new checks in Windows 7,8,10.
I know this in unpleasant news. But in case this wasn't already on your radar, it's far less painful to start the process of getting your code signing certificate re-issued and updating build settings before releasing an installer which alarms users with an invalid signature.
More info can be found here, and many other sites.