error! update is not signed by freedownloadmanager.org

[human]

hi, a make an update and in the end of download i have this message:
error! update is not signed by freedownloadmanager.org

[Usher]

How did you make the update? What application has shown the error message? What browser do you use? You should follow the reporting rules and provide detailed step-by-step description of your actions, software and links used.

Note that FDM doesn't use digital signing for its files and installer, but it doesn't install drivers, so you should NOT see system error messages. Maybe you have installed some adware or malware.

[Alex]

Fixed. Thank you for the report.

[Alex]

Note that FDM doesn't use digital signing for its files and installer

It does.

[Usher]

Note that FDM doesn't use digital signing for its files and installer

It does.

Could you explain which files are signed and how it is made?
I know that the compiler may write checksums/hashes into files and the installer uses some checksums/hashes to verify its integrity, but I can't see any file signed with certificate, as it is f.e. with Firefox. Compare FDM.EXE properties



with Firefox.exe properties - can you see "Podpisy cyfrowe" ("Digital Signatures") tab?

[Alex]

HI!

fdminst.exe is signed. It's the file auto updater downloads.
The digital sign helps FDM to make sure that the file is from us.

Digital sign format we use differs from Windows' one. That's why Windows does not recognize it.

[Alex]

I know that the compiler may write checksums/hashes into files and the installer uses some checksums/hashes to verify its integrity

No, it's not a checksum / etc. It's a real digital signature (uses private/public keys and so on).

[Usher]

Users trust in tools that are available in their OS by default, so you should use signing with certificate, no matter what tools are more convenient for developers.
Note that some people offered to make donations. Some of them possibly install FDM for corporate use and want to refund costs of certificate, I think.

[Usher]

I know that the compiler may write checksums/hashes into files and the installer uses some checksums/hashes to verify its integrity

No, it's not a checksum / etc. It's a real digital signature (uses private/public keys and so on).

Good digital signatures DO use hashes for security reasons - to prevent attacks.