chore: sign Windows binary with DigiCert EV certificate#51
Conversation
There was a problem hiding this comment.
Pull request overview
Adds Windows Authenticode signing to the release pipeline by introducing a dedicated sign-windows job that signs ant-node.exe via DigiCert SSM, then swaps the Windows archive before the existing post-quantum signing + checksum steps.
Changes:
- Add a
sign-windowsjob (Windows runner) to extract, sign, verify, and repackage the Windows binary. - Update the
signjob to depend onsign-windowsand replace the unsigned Windows ZIP with the signed ZIP prior to PQ signing/checksums. - Update GitHub Release notes to mention DigiCert EV signing for Windows.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jacderida
force-pushed
the
chore-sign_windows_binary
branch
from
cc6ca2e to
6801d2f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jacderida
force-pushed
the
chore-sign_windows_binary
branch
from
6801d2f to
097b81d
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add a sign-windows job to the release workflow that signs ant-node.exe using DigiCert SSM before the post-quantum signing step. The signed binary is repackaged into the release archive. Mirrors the approach used in ant-client. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jacderida
force-pushed
the
chore-sign_windows_binary
branch
from
cc0c2d8 to
e9acf60
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jacderida
force-pushed
the
chore-sign_windows_binary
branch
from
ca427c0 to
e9acf60
Compare
Summary
sign-windowsjob to the release workflow that signsant-node.exewith our DigiCert EV code-signing certificate via DigiCert SSMsignjob now depends onsign-windowsand swaps the unsigned Windows archive for the signed one before post-quantum signing and checksumsPorted from the working implementation in
ant-client.Test plan
dry_run: trueand a version likev0.5.0-rc.0sign-windowsjob passes (smctl healthcheck, signing, Authenticode verification)signjob replaces unsigned archive and produces correct checksumsRequired secrets (already configured)
SM_HOST,SM_API_KEY,SM_CLIENT_CERT_B64,SM_CLIENT_CERT_PASSWORD,SM_KEYPAIR_ALIAS🤖 Generated with Claude Code