Windows binaries are now code-signed with Authenticode

[AlexsJones]

We're excited to announce that all Windows release binaries are now signed with Authenticode via the SignPath Foundation program.

What this means for you

Starting with the next release, when you download llmfit for Windows:

• Windows SmartScreen warnings are eliminated — no more "Windows protected your PC" prompts
• Tamper verification — you can verify the binary hasn't been modified since it was built in our CI pipeline
• Trust chain — the signature is tied to our GitHub Actions build, ensuring the binary matches the source code

How it works

Our release pipeline now includes an automated signing step:

1. Windows binaries are built in GitHub Actions as before
2. The .exe is submitted to SignPath for Authenticode signing
3. The signed binary is repackaged and published to the GitHub Release

SignPath verifies that the signing request originates from our trusted GitHub Actions workflow, providing an auditable chain from source to signed binary.

Verifying signatures

On Windows, right-click the downloaded llmfit.exe → Properties → Digital Signatures tab to inspect the Authenticode signature.

Thanks to the SignPath Foundation for providing free code signing for open-source projects!

See PR #489 for the implementation details.