Software security for ImageGlass

[d2phap]

From Yawn:

Can you please use HTTPS (letsencrypt.org) and / or sign your Windows executable?

[Abdull]

It'd be great if ImageGlass' installer was signed, giving an additional layer of security to the existing method of comparing the SHA1 checksum provided at http://www.imageglass.org with the github.com EXE release.

System info:

• ImageGlass version: 4.0.4.15
• OS version: Windows 10

Other info:

Lately, some open source projects' websites were compromised (see e.g. HandBrake), having their installers infected. Having a signed installer gives confidence that this executable wasn't tampered with by a malicious actor.

[d2phap]

Hi @Abdull

Thanks for the information.
I also aware to this. However, currently I cannot effort for the code signing certificate.
The donation is just enough to cover hosting and domain service for a year.

As you can see, there is no ads in the app and the website because i don't want to interrupt user experience.
Anyway, I will try to do this by somehow.

[Abdull]

Thank you for reopening this issue. I'm happy to donate and wish you lots of follow-up donators in order to realize this request.

[d2phap]

Thanks @Abdull for the donation.
I really appreciate it 👍

[d2phap]

updated:
I've just moved to the new web server with SSL Cert.

what's next:
I will try to effort for a code signing cert for exe file

[cela96]

Forgive the answer if i say something incorrect but moving the link to installer on github/releases mantaining the cecksum on https://imageglass.org/ wouldn't improve the security?
The installer and the cecksum would actually be on two separate platforms with less risk for hacking.

[d2phap]

Hi @cela96
The installer/zip binary files of ImageGlass are currently hosted on Github. The ones on its website are just shortcut and link to Github.

:)

[d2phap]

ImageGlass 8.5 released with all binary files are signed.