We haven't made a product-level decision here, but a) it looks like
timestamp.digicert.com may have silently EOLed sha1 timestamps since
Microsoft has EOLed sha1 signing years ago, and b) it may be the case that
changing the signature may only affect Windows 7 SP 0 users on first
install. I'm not 100% sure about the second point.
Should we continue testing and rolling out, or pause work here until we
make a product decision?
Mar 18, 2021, 2:31:59 PMMar 18
Reply to author
Sign in to reply to author
Sign in to forward
You do not have permission to delete messages in this group
Report message as abuse
Sign in to report message as abuse
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
Per https://jira.mozilla.com/browse/RELENG-431, backwards compatibility
with win7 sp0 may not be a big issue, though I'm happy to delay rollout if
there are any additional concerns. I've linked sha2-signed artifacts in
that ticket; we may want to have a QA pass before we decide to roll out.