Skip to content

ci(windows): delete the dead Authenticode signing step - #51

Merged
z33b0t merged 1 commit into
mainfrom
ci/drop-dead-windows-signing
Jul 29, 2026
Merged

ci(windows): delete the dead Authenticode signing step#51
z33b0t merged 1 commit into
mainfrom
ci/drop-dead-windows-signing

Conversation

@z33b0t

Copy link
Copy Markdown
Contributor

Takes option 2 from #9. The sign exe step was gated on secrets.WINDOWS_CERT_PFX_BASE64, which has never been set — so it had never run, every Windows release we've shipped is unsigned, and the workflow read as though the opposite were true.

That's the part worth restating: it wasn't cosmetic. A security review of this repo produced a wrong, unshippable recommendation off the back of it — "verify the extracted exe's Authenticode signature before ApplyUpdate" — which would have rejected every genuine update. Config that looks load-bearing and isn't generates bad downstream decisions.

Removed

  • the sign exe step
  • the now-unused signed output from determine build mode — which was the only remaining reference to the cert secrets
  • the signing language in the header comment

Two things I did beyond deleting

  1. The header now records why, so nobody restores the step as an apparent oversight, and says what adding real signing actually requires: provision the secrets in the same change, and scope them to an Environment (Signing secrets are repo-scoped — a workflow_dispatch from any branch can reach them #20) rather than repo-wide. It also restates what signing doesn't buy — this workflow signs on any push to main or v* tag, so write access is enough to have CI sign a payload.
  2. Corrected the publish step's comment, which claimed a leaked contents:write token is defended against by "signing … and build provenance". On Windows that's now provenance (Release artifacts carry no build provenance attestation #24) and nothing else. That sentence was part of the same misleading picture.

Verification

  • YAML parses; every steps.*.outputs.* reference still resolves (cfg.release, ver.version, artifact.zip, artifact.name) — the deleted signed output has no remaining consumers
  • No functional change to what ships. The step never executed, so the artifacts are byte-for-byte what they were. The Windows build job runs on this PR and is the real check that the workflow is still valid.

The README was already corrected in #39 to stop claiming signed builds, so docs and workflow now agree.

Note: this touches .github/workflows/, so I can't merge it — same workflow scope block as #40.

Closes#9

windows.yml carried a `sign exe` step gated on secrets.WINDOWS_CERT_PFX_BASE64,
a secret that has never been set. The step had therefore never run, every
Windows release we have shipped is unsigned, and the workflow read as though the
opposite were true.
That was not cosmetic. A security review of this repo produced a wrong,
unshippable recommendation off the back of it — "verify the extracted exe's
Authenticode signature before ApplyUpdate" — which would have rejected every
genuine update, because there is no signature on any of them. Config that looks
load-bearing and isn't generates bad downstream decisions, so per the decision
on #9 it goes rather than staying as a placeholder.
Removed: the `sign exe` step, the now-unused `signed` output from `determine
build mode` (and with it the only reference to the cert secrets), and the
signing language in the header.
The header now states plainly that builds are unsigned and SmartScreen will
warn, records why the step was deleted so nobody "restores" it as an oversight,
and says what to do to add real signing — provision the secrets in the same
change, and scope them to an Environment (#20) rather than the repo.
Also corrects the publish step's comment, which cited signing as a defence
against a leaked contents:write token. On Windows that defence is the build
provenance attestation (#24) and nothing else.
No functional change to what ships: the step never executed, so the artifacts
are byte-for-byte what they were.
Closes#9
@z33b0t
z33b0t merged commit e09199f into mainJul 29, 2026
7 checks passed
@z33b0t
z33b0t deleted the ci/drop-dead-windows-signing branch July 29, 2026 23:31
@z33b0t

Copy link
Copy Markdown
ContributorAuthor

@z33b0t ready to merge. All 7 checks green, including Build & package Blurt (release) — the Windows job is the real check that the workflow is still valid after removing a step and an output.

I also verified the artifact, using the same method the issue used to establish the problem. Downloaded the zip this PR's run produced and parsed the PE optional header:

PE32+ Certificate table RVA=0x0 size=0 -> UNSIGNED

Identical to what #9 measured against the published v0.2 asset. That is the point: nothing about the shipped binary changes, because the deleted step never executed. The build still produces a valid 72 MB single-file PE32+ exe.

Confirms the workflow and reality now agree, rather than the file describing a signing path that never ran.

You'll need to merge this one — it touches .github/workflows/, so it hits the same workflow scope block as #40:

gh auth refresh -h github.com -s workflow

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Windows releases are unsigned — the sign step in windows.yml is dead code

1 participant

@z33b0t