Erica Franco 938542c78b Security: pin and verify the Windows signing client (#2936) (#3938) ...

sign.ps1 downloaded Microsoft.Trusted.Signing.Client from the unversioned
NuGet URL and loaded its dlib into signtool, next to the Azure signing
secrets, with no version or integrity check.

Download a pinned version (1.0.95, which the unversioned URL serves today)
and refuse it unless its SHA-256 matches, so upgrading the client is a
deliberate change in the repository. The release docs say where the pin
lives.

2026-10-25 12:32:10 -04:00

..

src

Security: pin and verify the Windows signing client (#2936) (#3938)

2026-10-25 12:32:10 -04:00

book.toml

docs: add mdBook and security documentation foundation (#35)

2026-10-04 12:31:18 -04:00