Windows: Authenticode code signing for the viewer and installer (SmartScreen / AV) #287

New issue

Open

opened 2026-10-04 07:22:37 +00:00 by sky_line · 1 comment

sky_line commented

2026-10-04 07:22:37 +00:00

Owner

Our Windows builds are unsigned: SmartScreen shows "Windows protected your PC" (users must click More info > Run anyway), some antivirus tools flag or quarantine unsigned installers, and users have no way to verify a download came from us. Related: #286 (Flatpak signing), Linux signing ticket.

What to sign

SlipstreamViewer.exe / slipstream-bin.exe and our own DLLs, the NSIS Setup.exe (and its uninstaller), and the bundled CEF/dullahan helper executables where we ship our own builds. Third-party DLLs already signed by their vendor stay as they are.
Use Authenticode SHA-256 with an RFC 3161 timestamp, so signatures stay valid after the certificate expires.

Certificate options

Azure Trusted Signing (Microsoft's managed signing): cheap monthly cost, builds SmartScreen reputation like EV, keys live in Azure (no hardware token). Eligibility: organisation, or individual developer identity validation (check current availability for individuals in our country). Likely best fit.
OV code-signing certificate (Certum open-source cert, SSL.com, Sectigo...): since 2023 the keys must live on a hardware token or cloud HSM. Certum's open-source developer certificate is cheap. SmartScreen reputation builds up over downloads.
EV certificate: immediate SmartScreen reputation, but expensive and token-bound. Probably not worth it versus Trusted Signing.
SignPath Foundation: free signing for OSS projects, if we qualify (needs a public repo and build-provenance requirements).

CI integration (applejack cross-builds Windows on Linux)

Sign on Linux with osslsigncode (PKCS#11 for an HSM/token, or a cloud signing API), or call Azure Trusted Signing's REST/jsign (jsign supports Trusted Signing, Azure Key Vault and PKCS#11 tokens, and runs on Linux, a good match for our cross-build).
Sign after the build and before NSIS packs (so the installed files are signed), then sign Setup.exe last. Verify with osslsigncode verify in CI and fail the release if verification fails.
Secrets: signing credentials as Forgejo Actions secrets, scoped to tag builds only (never PR builds). Document key rotation and revocation.

Also

Publish SHA-256 checksums for every release asset (also useful for Linux), shown on the release page.
Update the website and release notes text once signed: drop the SmartScreen "Run anyway" instructions.

Our Windows builds are unsigned: SmartScreen shows "Windows protected your PC" (users must click *More info > Run anyway*), some antivirus tools flag or quarantine unsigned installers, and users have no way to verify a download came from us. Related: #286 (Flatpak signing), Linux signing ticket. ### What to sign - `SlipstreamViewer.exe` / `slipstream-bin.exe` and our own DLLs, the NSIS `Setup.exe` (and its uninstaller), and the bundled CEF/dullahan helper executables where we ship our own builds. Third-party DLLs already signed by their vendor stay as they are. - Use Authenticode SHA-256 with an RFC 3161 timestamp, so signatures stay valid after the certificate expires. ### Certificate options - **Azure Trusted Signing** (Microsoft's managed signing): cheap monthly cost, builds SmartScreen reputation like EV, keys live in Azure (no hardware token). Eligibility: organisation, or individual developer identity validation (check current availability for individuals in our country). **Likely best fit.** - **OV code-signing certificate** (Certum open-source cert, SSL.com, Sectigo...): since 2023 the keys must live on a hardware token or cloud HSM. Certum's open-source developer certificate is cheap. SmartScreen reputation builds up over downloads. - **EV certificate**: immediate SmartScreen reputation, but expensive and token-bound. Probably not worth it versus Trusted Signing. - **SignPath Foundation**: free signing for OSS projects, if we qualify (needs a public repo and build-provenance requirements). ### CI integration (applejack cross-builds Windows on Linux) - Sign on Linux with `osslsigncode` (PKCS#11 for an HSM/token, or a cloud signing API), or call Azure Trusted Signing's REST/`jsign` (jsign supports Trusted Signing, Azure Key Vault and PKCS#11 tokens, and runs on Linux, a good match for our cross-build). - Sign after the build and before NSIS packs (so the installed files are signed), then sign Setup.exe last. Verify with `osslsigncode verify` in CI and fail the release if verification fails. - Secrets: signing credentials as Forgejo Actions secrets, scoped to tag builds only (never PR builds). Document key rotation and revocation. ### Also - Publish SHA-256 checksums for every release asset (also useful for Linux), shown on the release page. - Update the website and release notes text once signed: drop the SmartScreen "Run anyway" instructions.

sky_line added the

feature

platform

labels

2026-10-04 07:22:37 +00:00

sky_line referenced this issue

2026-10-04 07:22:43 +00:00

Linux: official Flatpak + self-hosted Flatpak repo (then Flathub) for distros without AUR/.deb #286

sky_line commented

2026-10-04 07:22:43 +00:00

Author

Owner