Sign Windows exe with golift/codesign@v1

[davidnewhall]

Summary

• Authenticode-sign unpackerr.amd64.exe with uses: golift/codesign@v1 (default Action install is from the action checkout, not golift.io).
• make release WINDOWS_ZIP=0 leaves the exe for the Action; make windows_zip packages afterward and refreshes checksums.sha256.txt without hashing that file into itself.
• Skip signing when CODESIGN_URL is unset.
• Add retries and failure-mode to unstable curl uploads.

Operator follow-up: repo/org secrets CODESIGN_URL, CODESIGN_CLIENT_CERT, CODESIGN_CLIENT_KEY, and allowlist Unpackerr/unpackerr on signerd.

Test plan

• Unstable/tag job still produces a Windows zip when secrets are unset (unsigned)
• After secrets + live signerd: Windows zip is Authenticode-signed

Made with Cursor

[cursor]

Stale comment

golangci-lint failed on darwin, linux, and freebsd with typecheck errors in Go’s standard library, not in this PR’s codesign changes:

crypto/internal/randutil/randutil.go: could not import math/rand/v2
math/rand/v2/rand.go: method must have no type parameters
undefined: rand

Why: lint jobs used go-version: 'stable', which now installs Go 1.27.0. golangci-lint v2.12 is built with Go 1.26 and cannot typecheck generic methods added in 1.27 (math/rand/v2). gotest on stable is unaffected.

Fix: point the golangci-lint setup-go steps at go-version-file: 'go.mod' (1.26.4), matching release.yml.

Follow-up commit: b10336f

Note: pull_request_target still runs the workflow from main, so those checks may stay red until this lands. The push workflow on this branch uses the updated file.

View PR

  

_{Sent by Cursor Automation: CI Failure Auto-Fixer}

[cursor]

Stale comment

golangci-lint (linux) and golangci-lint (darwin) are still red on this PR, but that is not a new code defect in the codesign work.

What failed
pull_request_target test-and-lint typecheck in Go’s standard library:

crypto/internal/randutil/randutil.go: could not import math/rand/v2
math/rand/v2/rand.go: method must have no type parameters
undefined: rand

Why
pull_request_target runs the workflow file from main, which still has go-version: 'stable' and golangci-lint v2.12. After Go 1.27, stable is 1.27.0. v2.12 cannot typecheck generic methods (now used by math/rand/v2). The job checkouts this branch’s code, but actions/setup-go still follows main.

What was already applied
The lint jobs on this branch pin Go with go-version-file: 'go.mod' (1.26.4):
b10336f

That is enough: the push test-and-lint run for cdf7e11 is green (linux/darwin/freebsd/windows lint all passed).

No further commit
Another workflow edit on this branch cannot change pull_request_target checks. Those stay red until the pin is on main. Merging may require bypassing the stale required lint checks from main’s workflow.

  

_{Sent by Cursor Automation: CI Failure Auto-Fixer}

[cursor]

Stale comment

CI on c461e6c is green. No failed checks (14 passed; 8 skipped build-and-release jobs, expected on a PR).

The earlier pull_request_target golangci-lint typecheck failures (math/rand/v2 / Go 1.27 vs golangci-lint v2.12) cleared after merging main, which now runs golangci-lint v2.13. No code fix was applied on this run.

  

_{Sent by Cursor Automation: CI Failure Auto-Fixer}

[cursor]

Make Release Assets failed on the unstable push of b543b64 (job 97613166666), not because of unpackerr workflow or binary code.

codesign: signing unpackerr.amd64.exe: signing service error: 500 Internal Server Error: signing failed

golift/codesign@v1 reached signerd (OIDC/mTLS did not return 401; the file was accepted as PE). The 500 is signerd’s catch-all when the backend fails. Debian osslsigncode 2.5 cannot overwrite -out (Failed to create file); signerd’s publishSigned left an empty CreateTemp staging file and passed that path as -out. Tracked as golift/codesign#14.

No unpackerr commit: pinning or editing this repo cannot fix the daemon. continue-on-error would ship an unsigned Windows zip.

After the signerd hotfix, the retried job (97615483187) signed successfully (signed unpackerr.amd64.exe in 9.285s). The unstable build-and-release run is green.

  

_{Sent by Cursor Automation: CI Failure Auto-Fixer}