Does the 7-Zip author still refuse to digitally sign or even provide hashes of the official downloads? It's an extremely weird flex, he thinks it's a frivolous waste of time or something.
7-zip is not a serious project and its use should be strongly discourged.
Modern Windows and OS X and Android and iOS are all worse than the old ones.
I’m not even joking, they are basically superior in every way. They open faster, they have only one visual axis and they support all the shell extensions you remember. (Too many shell extensions could make them just as slow though.)
I imagine an electron rewrite, with DirectX 12 and Copilot buttons everywhere
But I'm sure people blindly click through the "Unknown author" prompt just as they would ignore a certificate error.
Maybe it's high time for a free-as-in-beer CA for non-profit open source developers funded by donations?
Edit: I was wrong.
Prices on code signing certificates have skyrocketed to in excess of $500/year, due in part to continuing meddling by the CA/B forum which increased the requirements of standard certs to be the same as EV certs, and requiring the key to be stored in a hardware token—which must now be re-issued yearly.
This makes it near impossible to provide free or affordable certificates to developers. Thanks CA/B forum, lots of help as usual.
Note that the certificate itself is only for 1 year regardless of how long you buy one for and you need to go through the renewal process each year just without payment.
Orange when it's missing or invalid.
Whether Authenticode provides a sufficient authenticity check is yet another question, of course. Still, file integrity verification is just a side-effect.