Sign explicit owned Windows binaries, preserve third-party bytes/signatures, and verify final NuGet/Velopack distribution before publication. Protected release signing uses Azure OIDC, SHA256 and RFC3161 timestamps.
Validation: exact e3aaed4 CI38263239957 passes all required gates; 35 local signing regressions, conformance self-test/full API preflight and document/workflow/security lint pass. Real local representative six-binary and final installer/portable/update signing integration also passes; protected CI OIDC remains to be verified by the consumer release.
Maintainer confirmed review of exact e3aaed4 and resolution of all findings in this session, and authorized release publication.
Signed-off-by: James Maes <james@kof22.com>
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
james.maesandCodex
f896215ec9