(I forget exactly who to contact about the certificate, so I'm going
slightly more broad.)
The PSF's certificate we use to sign binaries and the installer for
Windows is a SHA-1 certificate, which has been deprecated as of the
start of the year: http://aka.ms/sha1
Already Windows may warn about the certificate on our current and past
releases, but because the signature is timestamped prior to 01Jan2016 it
will not be blocked. However, our next releases will be blocked (with a
bypass available) unless we update the certificate to SHA-2.
Some sources have suggested that CAs will provide a SHA-2 certificate
for free on request.
Supporting Windows Vista and Windows Server 2008 appears to be
complicated, according to the link I gave above. I want to test the
effect of only signing with SHA-2 on those platforms and make a
recommendation based on that, rather than trying to guess what will
happen (those OSs did not block downloaded files as aggressively as
Windows 7+).
Happy to take this off list once I know who handles this certificate.
Cheers,
Steve
_______________________________________________
python-committers mailing list
python-committers@python.org
https://mail.python.org/mailman/listinfo/python-committers
