GNOME Bugzilla – Bug 762640
The signature of gimp-2.8.16-setup-1.exe is corrupt or invalid... (due to only being signed with SHA-1)
Last modified: 2016-03-30 21:49:26 UTC
Once the download was complete, I received this error message - "The signature of gimp-2.8.16-setup-1.exe is corrupt or invalid", and prompts for deletion. On a Surface Pro 4 with Win10.
Are you using the Microsoft Edge browser? Has been identified as the trigger in https://twitter.com/bfritchie/status/703241740497526785 - maybe they got a reason for this, maybe not.
Same issue using IE 11 on Win 7
So, does one of you know what exactly the Microsoft browsers don't like about the existing signature?
Michael, I don't know what the issue is, but I just went back and downloaded the 22-November-15 version instead of the instead of the 18-February-2016 version, and did not have the problem. Since the version numbers seem to be the same for those, at least it will give you something to compare. I am an IT Manager with 30+ years experience, so am glad to help if I can. Just let me know.
The issue seems to be SHA-1 vs. SHA-2. https://github.com/git-for-windows/git/issues/592
A new build with correct signature has been released -> FIXED.