1.7.0.227 install error

[tharmon22]

Hi I tried updating yesterday but on installation kept getting the setup failed error. I came to the forum today to see if I could find any help regarding this and came across the manual update link posted at the top. I tried this link and this is the message I got. Can anyone advise what to do

[JFisher]

Hi tharmon22,

Can you right click the .exe and go to properties and confirm the size of the download? Try downloading the file from here and let me know if this works any better for you. 

If not, please follow the instructions provided in this thread and upload the log files here and I will investigate this for you

[Alfred]

2 hours ago, JFisher said:

Can you right click the .exe and go to properties and confirm the size of the download?

If the download is complete, there will be a Digital Signatures tab in the Properties dialog. Checking the signer listed on that tab (or any of the signers, if there is more than one) will reveal whether or not the associated digital signature is OK.

[Pšenda]

20 hours ago, Alfred said:

If the download is complete, there will be a Digital Signatures tab in the Properties dialog. Checking the signer listed on that tab (or any of the signers, if there is more than one) will reveal whether or not the associated digital signature is OK.

Do you think this guarantees file integrity?
This would have to load the contents of the entire file before the signature was displayed - and that's delayed (signature information (in Win) will be displayed immediately).
For integrity checks are used hash/digest, such as MD5/SHA1. This will not only allow integrity checks (completion of download), but also that is no "add-on" version.
That's why most companies also report it on their downloaded files.

[Alfred]

1 hour ago, Pšenda said:

Do you think this guarantees file integrity?

Yes, I do.

[Pšenda]

11 hours ago, Alfred said:

Yes, I do.

Unfortunately, this is not true.
Viewing digital signatures in the file properties tab only "shows" the signature, but does not "verify" it.

For demonstration, I made a copy of that beta exe file, and every 0xFFFF byte I damaged (I did its inversion).

Damage to the file is also evident from the difference in their MD5 digest.
99bb4b44463bc0c02863a361c0e545bf *affinity-publisher-beta-1.7.0.227.exe
355a55a49c93930dd8dff1c163b60ac5  *affinity-publisher-invalid.exe

But signatures of this corrupted file are displayed!

Guarantee this way the integrity of the file is definitely incorrect!

Placing digest/hash (MD5, SHA) with exe files would certainly be appropriate.

 

Edit: Corrupted exe file can normally run, ask for an update, but it will stop.
It is obvious, that file integrity and signature verification are not performed during installation. Which I think is a mistake.

[Alfred]

13 hours ago, Pšenda said:

Damage to the file is also evident from the difference in their MD5 digest.
99bb4b44463bc0c02863a361c0e545bf *affinity-publisher-beta-1.7.0.227.exe
355a55a49c93930dd8dff1c163b60ac5  *affinity-publisher-invalid.exe

 But signatures of this corrupted file are displayed!

Your screenshot shows that you haven’t checked either of the entries in the list (for sha1 or sha256). If you click on one of those entries to highlight it, the ‘Details’ button (labelled ‘Podrobnosti’ in your screenshot) will become enabled, and when you press it the integrity check will be performed.

[Pšenda]

Thanks, I have read your previous post wrongly :-)