666479 - docs should note that the Windows SeaMonkey installer causes 2 security alerts

Status: RESOLVED FIXED

(SeaMonkey :: Website, defect)

Description

[skierpage]

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20110608 Firefox/4.0.1 SeaMonkey/2.1
Build Identifier: 2.2b1

I downloaded and ran SeaMonkey Setup 2.2b1.exe on Windows Vista.  Because the installer is unsigned, I got two security alerts.  Users will feel more confident about installing if the docs mention these.

Reproducible: Always

Steps to Reproduce:
1. Download SeaMonkey 2.2b1 on Windows Vista
2. Run the installer


Actual Results:  
In Windows Vista I got two alerts. First

  Open File - Security Warning
  "The publisher could not be verified. Are you sure you want to run this software.
  Publisher: Unknown Publisher
  From: \path\to\download\SeaMonkey Setup 2.NNN.exe
  This file does not have a valid digital signature. ...

Then if you click [Run], after extracting I get a Windows UAC alert.

  User Account Control
  An unidentified program wants access to your computer.
  ...
  setup.exe
  Unidentified Publisher.

and you must click the Allow text to continue.

Expected Results:  
Someone on #seamonkey IRC commented the unsigned installer is unlikely to be fixed soon.  I think the Release Notes http://www.seamonkey-project.org/releases/seamonkey2.2/ and the installation document (none for 2.2 yet, currently http://www.seamonkey-project.org/doc/2.1/install-and-uninstall) should mention the security alerts.

I suggest web text similar to the following:

in http://www.seamonkey-project.org/releases/seamonkey2.2/#issues , in the Windows section add a bullet point:

"The Windows installer for SeaMonkey is not signed, so during installation you will have to click past a security warning and probably a User Account Control warning."

in the replacement for http://www.seamonkey-project.org/doc/2.1/install-and-uninstall, replace
  3. Follow the on-screen instructions in the setup program. The program starts automatically the first time.

with 
"3. The Windows installer for SeaMonkey is not a signed binary, so during installation you will have probably have to click to continue past one or two security warnings.  The first warns that SeaMonkey Setup 2.NNN.exe does not have a valid digital signature, but assuming you downloaded it from a link on www.seamonkey-project.org it is trustworthy and you can click [Run] to continue.  The second in Windows Vista and Windows 7 is a User Account Control warning that "An unidentified program wants access to your computer", setup.exe.  This is the setup program inside the SeaMonkey installer, so click Allow to continue.

4. Follow the on-screen instructions in the setup program.
5. Run SeaMonkey and enjoy!
"

I couldn't find a bug for the SeaMonkey Windows installer not being signed, if there is this bug should be a dependency of it and the rel notes should link to it.

Comment 1

[Jens Hatlak (:InvisibleSmiley)]

Attachment: patch

Attached what I just landed. I also found that we didn't have 2.2 docs yet, but I didn't want to start copying the whole structure (including all those screen shots!) for all future releases, so for now I just added a note there.

Checking in src/doc/index.en.html;
/www/seamonkeyproject-org/src/doc/index.en.html,v  <--  index.en.html
new revision: 1.10; previous revision: 1.9
done
Checking in src/doc/2.1/install-and-uninstall.en.html;
/www/seamonkeyproject-org/src/doc/2.1/install-and-uninstall.en.html,v  <--  install-and-uninstall.en.html
new revision: 1.4; previous revision: 1.3
done