Update image not signed?

[Bappy1988]

I've just started using AppImageLauncher instead of manually moving files around and creating .desktop files. very helpful thanks.

I've seen that some AppImages release with some update information, and AppImageLauncher adds an update option on the context menu of the desktop file. Very nice. However on all of the AppImages I've tried this with, it downloads all the data and then says
Signature validation problem: AppImage not signed

The file is present in ~/Applications but from what I can tell it hasn't been integrated.

Is there an issue here? A setting I need to change perhaps?

I understand that if a downloaded AppImage has an incorrect or invalid signature, that is perhaps an indication of tampering, but if a software vendor simply doesn't sign their AppImage at all that shouldn't prevent integration should it? Or am I missing some fundamental detail about the AppImage spec?

[TheAssassin]

No, it's usually fine, this is a usability issue on our end, I would say. Most AppImage creators do not sign their AppImages. It would be better as it would allow AppImageUpdate to make sure the update is authentic. Back when writing that code in AppImageUpdate, it didn't seem like a good idea to mark an update "green" if the update could not be authenticated. However, making the bar yellow although the update technically worked is not great either.

We might instead just add a dialog asking whether the update should be accepted despite not being signed, I guess.

Please open an issue over at AppImageUpdate.

[Bappy1988]

Thanks :) I'll open an issue.

[Bappy1988]

So there's already an issue that's been open for 4 years lol

AppImageCommunity/AppImageUpdate#173

I have discovered the true source of my issue though. I had turned off the auto-integration daemon, not realising the update process relied on that to actually create the desktop file when it had finished updating. I was looking through the update code thinking - it doesn't integrate the update anyway!