Sign Windows executables with code signing certificate

[darktorres]

Description

Sign the Windows executable with a code signing certificate to avoid Windows Defender / SmartScreen warnings and build user trust. Consider using SignPath or a similar CI-integrated signing service.

Acceptance Criteria

• Release executables are automatically signed in CI
• Certificate is valid and trusted by Windows
• Signing process is documented
• No SmartScreen warnings on first download

Implementation Guide

1. Certificate options

• SignPath.io: Free for open-source projects, integrates with GitHub Actions
• Self-signed + Windows SDK: signtool.exe with a purchased code signing certificate
• Let's Encrypt: Not suitable for code signing (only TLS)

2. SignPath integration (recommended)

• Apply for free OSS plan at signpath.io
• Add a signing step to .github/workflows/deploy.yml after the Windows build
• SignPath provides a GitHub Action: SignPath/github-actions-sign@v1
• Store signing credentials as GitHub secrets

3. Alternative: signtool + purchased certificate

• Purchase an EV code signing certificate (e.g., from DigiCert, Sectigo)
• Store the certificate as a GitHub secret (base64-encoded .pfx)
• Add a step to deploy.yml: signtool sign /f cert.pfx /p $password /tr http://timestamp.digicert.com wiredpanda.exe

Key files

• .github/workflows/deploy.yml — Windows build and release step