Files
solvecraft/packaging
bherbruck 9e4dc48165 Release: sign Windows binaries and MSI through SignPath Foundation (#7067)
* Release: sign the Windows binaries and MSI through SignPath Foundation

When the SIGNPATH_API_TOKEN secret exists, each Windows job sends the
three .exe files to SignPath before packaging, then the MSI built from
them, using the GitHub artifact flow from SignPath's docs. The policy
is test-signing unless the signpath_signing_policy dispatch input or
the SIGNPATH_SIGNING_POLICY repository variable says otherwise. Without
the secret the jobs build unsigned exactly as before.

package.ps1 gains -Phase stage|package so signing can sit between the
build and the MSI; the artifact configuration to paste into SignPath is
packaging/windows/signpath-artifact-configuration.xml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* SignPath: drop the description attributes the Foundation plan doesn't allow

SignPath Foundation projects get an automatic signature description (its watermark);
the artifact configuration may not override it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-26 19:47:06 +00:00
..