Signature signatures on executables and installer use vulnerable SHA1 hash

Brought to you by: anton19286, const_k, crazy-walrus

#1637 Signature signatures on executables and installer use vulnerable SHA1 hash

Milestone: None

Status: open-accepted

Owner: nobody

Labels: None

Priority: 5

Updated: 2025-08-19

Created: 2024-10-10

Private: No

SHA1 has been known to be vulnerable for a long time, as reported by Google:
https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
Digital signatures should be using SHA256 or SHA512, not SHA1, or they offer false protection.

Zefram Cochrane - 2024-10-10

No way to edit ticket title. Sigh.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anton - 2025-08-19

will be changed to sha256 in the next release

If you would like to refer to this comment somewhere else in this project, copy and paste the following link: