I have downloaded ROOT binary installer from https://root.cern/download/root_v6.32.00.win64.vc17.exe. When running the executable Windows prompts that the executable is untrusted. Checking the executable shows that it’s not signed.
Question:
Is it possible to sign the executables to ensure that they haven’t been modified?
Maybe at the least provide some MD5 hashes on the website so that I can compare the downloaded executable to the hash?
I couldn’t find an existing bug report for this. I was in the process of opening a new one and it asked me if I had checked Jira for a duplicate. I clicked on the link provided and I get the following message: