Has the pandoc.exe digital signature expired?

So we're using the portable ZIP version of R Studio for Windows 10/11 RStudio Desktop - Posit, actually it might the previous version, but I can see the same issue with the current.

We're finding that when using rmarkdown to render, our ICT is somtimes blocking ...\RStudio-2023.12.1-402\resources\app\bin\quarto\bin\tools\pandoc.exe due to a digital signature that expired on the 10th of September.

I don't know enough about digital signatures/certificates etc so asking for general advice. Maybe it's an issue on our end?

We have a workaround if anyone is interested, but I'm keen to hear other perspectives.

I don't think this is on your end.

Does it happens with latest RStudio-2024.09.0-375.zip too ?

Hi thanks for looking at this. I believe it also affects RStudio-2024.09.0-375.zip. I've checked on both work and personal PCs.

Have you verified the digital signature through the file's properties or using a command-line tool to confirm if it has actually expired?

So I have checked and the pandoc.exe comes from Quarto bundle. Latest 1.5 where binaries has been signed with a certificate valid at the time - The expire date is after the bundle creation done at the release.

Since then, new bundles have an updated certificate (latest 1.6 pre-release built since then are ok), but the old binaries are not resigned.

Is using current 1.5 causing a problem because of this ? The obvious workaround to have new certificate is using 1.6 pre release. Next patch release for 1.5 (probably next week) will be signed wit renewed certificate FWIW.

Hi cderv thanks for checking. Our workaround is simply to replace pandoc.exe with one downloaded directly from the Pandoc GitHub. We aren't really sure why it's blocked by our ICT policy on some analysts' PCs and not others, so no rush.

This exe file is not signed at all. So indeed it won’t have an expirery date.

If you are a quarto user, it could have some side effect to replace by a different version. Be sure to replace by the same pandoc version if you go this road.

If you just install a new version and put on PATH no issue.

I didn’t know expirery date can be a problem. This should not happen anymore with new Posit certificates. Sorry for the trouble