feat(releases): verify Windows Artifact Signing before publication #31

Merged

KofTwentyTwo merged 3 commits from feat/artifact-signing-catalogs into main

2026-10-12 14:53:15 +00:00

Author	SHA1	Message	Date
james.maesandCodex	e3aaed4e5a	chore(signing): sync catalog builder with current main Retain current exception-register decisions without changing the signing implementation. Verified all 35 signing regressions, conformance self-test/static checks, changed-document lint and workflow syntax/security gates. Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>	2026-10-12 09:28:37 -05:00
james.maesandCodex	5887a839b2	feat(releases): sign owned Windows artifacts before packaging Use repository-scoped Azure OIDC and the exact verified helper snapshot. Preserve third-party bytes and signatures, sign Velopack helpers through its supported hook, and stop publication unless final distributed binaries and embedded installer payloads verify. Refs: KofTwentyTwo/AppKit#12, KofTwentyTwo/AppKit#24 Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>	2026-10-10 17:44:18 -05:00
james.maesandCodex	3334d02b90	feat(signing): add verified Windows artifact helpers Prepare explicit owned-file catalogs, reject malformed PE inputs and verify preserved dependencies and exact final distribution payloads. Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>	2026-10-10 17:43:02 -05:00

Author

SHA1

Message

Date

james.maesandCodex

e3aaed4e5a

chore(signing): sync catalog builder with current main

Retain current exception-register decisions without changing the signing implementation. Verified all 35 signing regressions, conformance self-test/static checks, changed-document lint and workflow syntax/security gates.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

2026-10-12 09:28:37 -05:00

james.maesandCodex

5887a839b2

feat(releases): sign owned Windows artifacts before packaging

Use repository-scoped Azure OIDC and the exact verified helper snapshot. Preserve third-party bytes and signatures, sign Velopack helpers through its supported hook, and stop publication unless final distributed binaries and embedded installer payloads verify.

Refs: KofTwentyTwo/AppKit#12, KofTwentyTwo/AppKit#24

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

2026-10-10 17:44:18 -05:00

james.maesandCodex

3334d02b90

feat(signing): add verified Windows artifact helpers

Prepare explicit owned-file catalogs, reject malformed PE inputs and verify preserved dependencies and exact final distribution payloads.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

2026-10-10 17:43:02 -05:00