I think that distributing unsigned MSI is better solution, so system
would't complain about invalid signature.
Provided SHA-1 is good enough IMHO.
GnuPG asc file would be nice(some Linux distros do that), but I don't think
that It's necessary.
For time being i have manually extracted files, and updated links. It works
fine :-)
Thanks for your time (and quick answer).
--
Michael
2014-10-21 20:00 GMT+02:00 kmx via RT <bug-Perl-Dist-Strawberry@rt.cpan.org>
:
Show quoted text> <URL:
https://rt.cpan.org/Ticket/Display.html?id=99703 >
>
>
> > Hello,
> >
> > I tried to update my Perl installation, but it looks like certificate
> used
> > to sign installation file was revoked.
> >
> > File: strawberry-perl-5.20.1.1-64bit.msi from strawberryperl.com
> >
> > I still use Perl in my build scripts under Unix and Windows, but I cannot
> > install untrusted package due to company's security policies.
> >
> > Is this issue known to You ?
> > Will there be fixed, new package any time soon ?
>
> Hi,
>
> I know about this issue (both 32/64bit MSI for 5.20.1.1 are invalid).
>
> The trouble is that somebody at Certum CA lost scanned copy of my passport
> which I have sent them approx. a year ago. Unfortunately the reminder they
> sent me was "swallowed" by cpan.org's spam filter and they simply revoked
> my certificate.
>
> I am trying to get a new certificate but I am seriously considering to
> start distributing unsigned MSI files as I am really fed up with dealing
> with Certum CA.
>
> --
> kmx
>
>
