From 412c2dc877cfd27413bfc134556e4c543ae77ca7 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Tue, 4 Aug 2026 21:25:14 -0400 Subject: [PATCH] Record the code-signing decision Waiting for a certificate from the organisation's own certificate authority rather than buying one from a public CA. Every server this installer runs on is centrally managed and already trusts that root, so an internally issued Authenticode certificate removes the unknown-publisher warning exactly where it matters; a public certificate would buy trust on machines this software never reaches. Notes the interim measure that costs nothing: publish the SHA-256 through a channel separate from the installer, since a hash beside the file is only as trustworthy as write access to that location. Wording avoids naming internal infrastructure, since docs/ is published. --- docs/RELEASING-WINDOWS.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/RELEASING-WINDOWS.md b/docs/RELEASING-WINDOWS.md index c8c26e1..658d805 100644 --- a/docs/RELEASING-WINDOWS.md +++ b/docs/RELEASING-WINDOWS.md @@ -154,6 +154,23 @@ warning, and the SHA-256 is the only integrity check. This is the significant remaining gap before wider distribution: a checksum published next to the file protects against corruption, not against someone who can write to that location. +The decision taken is to wait for a certificate from the organisation's own +certificate authority rather than buy one from a public CA. Every server this +installer runs on is centrally managed, and that CA's root is already trusted on +those machines, so an internally issued Authenticode certificate removes the +warning exactly where it matters. A public certificate would buy trust on +machines this software never reaches. + +Until then, publish the SHA-256 through a channel SEPARATE from the installer +itself. A hash sitting beside the file is only as trustworthy as write access to +that location; a hash the operator gets another way means tampering has to +succeed twice. + +Wiring it up afterwards is small: Inno has native SignTool support, so a +directive in the script and a signtool configuration on the build machine sign +the installer and its uninstaller. Include a timestamp server, or signatures +stop verifying when the certificate expires. + **Compiling requires Windows.** `build-installer.ps1` exists so the whole process can run on a Windows workstation. Nothing about it runs in CI, so a release is a deliberate act by a person.