feat(releases): verify Windows Artifact Signing before publication #31

2026-10-10T22:52:20Z

KofTwentyTwo commented

2026-10-10 22:52:20 +00:00

(Migrated from github.com)

The Windows builders now sign explicit owned files while preserving third-party bytes and signatures, then verify the artifacts actually shipped. This adds protected-environment Azure OIDC signing for NuGet and Velopack, SHA256/RFC3161 timestamps, required publisher verification, PE source validation, unchanged dependency checks and Setup embedded-package checks before upload, checksums, SBOMs and provenance. Untrusted PRs have no signing path.

The branch is updated to current main c95e9e2; exact review head is e3aaed4e5a99b68e40616f39d3b0f8c147fbe7cf. Its PR diff remains the signing implementation. Helpers are pinned to reviewed ancestor 3334d02; this snapshot remains unpublished preparation. Modern and legacy variable names are supported. Migrating consumers must enable required signing or keep publication blocked.

Validation: exact-head CI 38263239957 completed successfully, including Windows signing, conformance, docs, dependency/DCO/title gates and security/CodeQL checks. All 35 signing/wrapper tests also pass locally with zero skips; conformance self-test/static checks, changed-document Markdown lint, actionlint 1.7.12 and zizmor 1.30.1 pass. Topic commits are signed and signed off.

MarkdownViewr's separate representative local six-binary signing test now passes actual signature/publisher/trust/timestamp/digest verification. This does not prove this builder's protected OIDC signing or final installer/archive integration; those must pass after review/publication before production release. No certification or signed production release is claimed. Refs KofTwentyTwo/AppKit#12 and KofTwentyTwo/AppKit#24.

Substantial implementation/review assistance: Codex (GPT-6).

The Windows builders now sign explicit owned files while preserving third-party bytes and signatures, then verify the artifacts actually shipped. This adds protected-environment Azure OIDC signing for NuGet and Velopack, SHA256/RFC3161 timestamps, required publisher verification, PE source validation, unchanged dependency checks and Setup embedded-package checks before upload, checksums, SBOMs and provenance. Untrusted PRs have no signing path. The branch is updated to current main `c95e9e2`; exact review head is `e3aaed4e5a99b68e40616f39d3b0f8c147fbe7cf`. Its PR diff remains the signing implementation. Helpers are pinned to reviewed ancestor `3334d02`; this snapshot remains unpublished preparation. Modern and legacy variable names are supported. Migrating consumers must enable required signing or keep publication blocked. Validation: [exact-head CI 38263239957](https://github.com/KofTwentyTwo/standards/actions/runs/38263239957) completed successfully, including Windows signing, conformance, docs, dependency/DCO/title gates and security/CodeQL checks. All 35 signing/wrapper tests also pass locally with zero skips; conformance self-test/static checks, changed-document Markdown lint, actionlint 1.7.12 and zizmor 1.30.1 pass. Topic commits are signed and signed off. MarkdownViewr's separate representative local six-binary signing test now passes actual signature/publisher/trust/timestamp/digest verification. This does not prove this builder's protected OIDC signing or final installer/archive integration; those must pass after review/publication before production release. No certification or signed production release is claimed. Refs KofTwentyTwo/AppKit#12 and KofTwentyTwo/AppKit#24. Substantial implementation/review assistance: Codex (GPT-6).

KofTwentyTwo commented

2026-10-12 14:38:26 +00:00

(Migrated from github.com)

Local final-package signing proof completed without installing or publishing the test package.

Using the exact reviewed signing wrapper at standards e3aaed4, pinned Velopack 1.2.161 and the signed six-binary 321816c input, produced a distinct disposable installer, portable ZIP and full update package. The strict distribution gate passes expected publisher/trust, SHA256 digests and RFC3161 timestamps for owned binaries and generated helpers, preserves third-party binary bytes, and verifies the signed installer embeds the exact full package. Final checksums were generated after signing. Evidence remains local under artifacts/signing-proof-321816c; owner preview binaries/profiles are unchanged.

This is actual local packaging integration under the authorized interactive signer. New CI OIDC authentication and protected release execution remain unproved; no stable 1.0/dev publication or installed signed-release acceptance is claimed.

Separately, current 313d258 installed job failed during dependency restore before tests. Its actual process-1 log is retained; the job has been retried once on the same commit with full original test cases/deadlines. Preserve the live attempt. Standards PR #31 is updated to current main and has terminal green exact-head CI; its genuine human review/publication is pending. Draft license proposal #32 now uses unused EX-0013, remains proposed, and has green checks; no exception was approved or activated.

Local final-package signing proof completed without installing or publishing the test package. Using the exact reviewed signing wrapper at standards `e3aaed4`, pinned Velopack 1.2.161 and the signed six-binary `321816c` input, produced a distinct disposable installer, portable ZIP and full update package. The strict distribution gate passes expected publisher/trust, SHA256 digests and RFC3161 timestamps for owned binaries and generated helpers, preserves third-party binary bytes, and verifies the signed installer embeds the exact full package. Final checksums were generated after signing. Evidence remains local under `artifacts/signing-proof-321816c`; owner preview binaries/profiles are unchanged. This is actual local packaging integration under the authorized interactive signer. New CI OIDC authentication and protected release execution remain unproved; no stable 1.0/dev publication or installed signed-release acceptance is claimed. Separately, current `313d258` installed job failed during dependency restore before tests. Its actual process-1 log is retained; the job has been retried once on the same commit with full original test cases/deadlines. Preserve the live attempt. Standards PR #31 is updated to current main and has terminal green exact-head CI; its genuine human review/publication is pending. Draft license proposal #32 now uses unused EX-0013, remains proposed, and has green checks; no exception was approved or activated.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#31