existing launcher cannot update itself to it, and until you replace it, it will keep trusting a key anyone can read.
Security
-
The private key that signed launcher updates had been committed to this public repository with an empty passphrase, so anyone could have produced an update the launcher would accept and install. This build ships a new key and stops new installs joining that pool.
It cannot rescue installs that already exist. Builds up to and including 0.3.1 carry the old public key, will reject anything signed with the new one, and need one manual reinstall to recover — this release, downloaded and installed by hand.
Changed
- Internal version numbers that had drifted behind since 0.2.6 were brought back into line. Shipped installers were always labelled correctly, so this is tidying rather than a fix.