Summary
The release workflow (release.yml:28-29) publishes the win-x64 self-contained executable without Authenticode code signing. On modern Windows installations, an unsigned executable downloaded from the internet triggers SmartScreen "Windows protected your PC" warnings on first run, and many corporate environments block unsigned executables outright via AppLocker / WDAC. The result: Windows users have a friction-heavy first experience and IT-managed environments simply cannot run cdidx.
Where
.github/workflows/release.yml:28-29 (win-x64 publish step)
Suggested approach
(1) Acquire an Authenticode code-signing certificate (Sectigo / DigiCert / SSL.com OV cert is the lowest-friction option; EV cert removes SmartScreen prompt entirely but costs more). (2) Store the cert + password in repo secrets (WIN_SIGNING_CERT_BASE64, WIN_SIGNING_CERT_PASSWORD). (3) Add a signing step to the win-x64 build job that runs signtool sign /td sha256 /fd sha256 /tr http://timestamp.digicert.com cdidx.exe after publish. (4) Verify with signtool verify /pa /v cdidx.exe in CI before upload. (5) Document the trust path: which cert, which CA, how to verify the binary's signature. (6) For the macOS analogue, file a separate issue covering Apple Developer ID + notarization. (7) Cross-link with #1795 (GPG verify install script — same trust-chain family) and the just-filed #463 (sha256sums signing).
Summary
The release workflow (release.yml:28-29) publishes the win-x64 self-contained executable without Authenticode code signing. On modern Windows installations, an unsigned executable downloaded from the internet triggers SmartScreen "Windows protected your PC" warnings on first run, and many corporate environments block unsigned executables outright via AppLocker / WDAC. The result: Windows users have a friction-heavy first experience and IT-managed environments simply cannot run cdidx.
Where
.github/workflows/release.yml:28-29(win-x64 publish step)Suggested approach
(1) Acquire an Authenticode code-signing certificate (Sectigo / DigiCert / SSL.com OV cert is the lowest-friction option; EV cert removes SmartScreen prompt entirely but costs more). (2) Store the cert + password in repo secrets (
WIN_SIGNING_CERT_BASE64,WIN_SIGNING_CERT_PASSWORD). (3) Add a signing step to the win-x64 build job that runssigntool sign /td sha256 /fd sha256 /tr http://timestamp.digicert.com cdidx.exeafter publish. (4) Verify withsigntool verify /pa /v cdidx.exein CI before upload. (5) Document the trust path: which cert, which CA, how to verify the binary's signature. (6) For the macOS analogue, file a separate issue covering Apple Developer ID + notarization. (7) Cross-link with #1795 (GPG verify install script — same trust-chain family) and the just-filed #463 (sha256sums signing).