Skip to content

Security Code Signing

Jump to bottom
github-actions[bot] edited this page Sep 21, 2026 · 2 revisions

Code Signing

Windows

The Windows setup workflow can use:

  • WINDOWS_CERTIFICATE_B64
  • WINDOWS_CERTIFICATE_PASSWORD

to construct a temporary PFX, sign Setup.exe with SignTool using SHA-256 and a timestamp server, and verify the result with signtool verify /pa /all.

When those secrets are absent, the release remains unsigned.

macOS

Production Apple trust requires Apple-issued credentials. The release-readiness workflow recognizes:

  • APPLE_CERTIFICATE_P12_B64
  • APPLE_CERTIFICATE_PASSWORD
  • APPLE_SIGNING_IDENTITY
  • APPLE_API_KEY_B64
  • APPLE_API_KEY_ID
  • APPLE_API_ISSUER

These credentials are intentionally stored only as GitHub Actions secrets. The workflow must not claim Developer ID signing or notarization unless the corresponding signing and verification steps actually succeed.

Release readiness

Run Release readiness manually for a release tag. The gate verifies release assets and SHA-256 manifests and can be configured to fail when Windows or macOS publisher-trust credentials are missing.

Important distinction

  • SHA-256 = artifact integrity
  • GitHub attestation = build/provenance signal
  • Authenticode / Developer ID = publisher identity and OS trust

One does not replace another.

Clone this wiki locally