Skip to content

v1.5.1 - Signed Windows downloads

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Sep 17:36
· 4 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.5.1
47dfae8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Signed Windows downloads

Windows direct downloads in this release are Authenticode-signed by MASTERPANEL LLC and timestamped using Azure Artifact Signing. The packaged application, elevation helpers and embedded uninstallers are signed as well. Windows can identify the publisher and detect changes to signed files; signing does not guarantee that SmartScreen will stop warning.

What changed

  • Shorter installer permission-prompt name: Open Desktop Authenticator.
  • Clearer publisher labels identifying MASTERPANEL LLC, and About text explaining that Master Panel is a separate product with no shared accounts or data.
  • Gated signing, final-signature verification and development-tool security updates.

No authenticator protocol, vault-format or production dependency changes are included. Application identity and vault locations are unchanged. Existing v1.5.0 assets have not been replaced and its Windows executables remain unsigned.

Choose your download

  • Most Intel/AMD Windows PCs: open-desktop-authenticator-1.5.1-x64-setup.exe.
  • Windows on ARM: open-desktop-authenticator-1.5.1-arm64-setup.exe.
  • Combined x64/ARM64 installer: open-desktop-authenticator-1.5.1-setup.exe.
  • Portable x64, manual updates: open-desktop-authenticator-1.5.1-portable.exe.
  • Linux x64: .AppImage or -amd64.deb. Linux files are not platform code-signed; use the checksums and provenance below.

The Microsoft Store is a separate distribution channel; this GitHub release does not update its package. No macOS download is included.

Verification

On Windows, open Properties → Digital Signatures → Details. The signature should be valid and identify MASTERPANEL LLC. In PowerShell:

Get-AuthenticodeSignature .\open-desktop-authenticator-1.5.1-x64-setup.exe | Format-List Status,SignerCertificate,TimeStamperCertificate
Get-FileHash .\open-desktop-authenticator-1.5.1-x64-setup.exe -Algorithm SHA256

Compare the file hash with its entry in SHA256SUMS.txt. On Linux, after downloading that list and the files you need:

sha256sum --check --ignore-missing SHA256SUMS.txt

The checksum list is separately signed with Sigstore. Download SHA256SUMS.txt, SHA256SUMS.txt.sig and SHA256SUMS.txt.pem, then verify using cosign v2:

cosign verify-blob SHA256SUMS.txt --signature SHA256SUMS.txt.sig --certificate SHA256SUMS.txt.pem --certificate-identity https://github.com/opendesktopauthenticator/open-desktop-authenticator/.github/workflows/release.yml@refs/tags/v1.5.1 --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify an executable's GitHub build provenance, substituting another downloaded binary when appropriate:

gh attestation verify open-desktop-authenticator-1.5.1-x64-setup.exe --repo opendesktopauthenticator/open-desktop-authenticator

sbom.spdx.json lists the shipping dependency tree. More context: verification guide, source changelog.

Testing and limits

The v1.5.1 release workflow passed Windows and Linux automated tests, final Windows signature verification, the portable-runtime check, packaging, checksum-signature verification and build-provenance generation. The preceding signed Windows smoke build was also installed and tested by the maintainer, with Windows showing the verified publisher. This is not an independent security audit. Native ARM64 execution and Linux manual runtime checks are not claimed here; the founder test plan records the existing broader manual-test gaps.

Back up your vault and recovery information before an upgrade. Use the installer for your architecture, and keep portable vault data when replacing the portable executable.

Assets 13
Loading