Windows Code Signing

Overview

Authenticode signing for Windows installers, the app executable and the uninstaller via Azure Artifact Signing (jsign on Linux CI). Reduces SmartScreen and endpoint-security false positives; enables signature verification on auto-updates.

How it works

• Custom sign hook in package_scripts/sign-windows.cjs — storetype TRUSTEDSIGNING, SHA-256, automatic timestamping.
• .windows_sign CI template: downloads jsign, fetches Entra ID OAuth token, signs installer + app + uninstaller.
• WIN_SIGN gate: default off — internal snapshots package without Azure creds; release jobs (pkg:win:beta, pkg:win:beta:prod, pkg:win:stable) set WIN_SIGN=true and fail hard if creds are missing.
• verifyUpdateCodeSignature in package.json so auto-updates validate the publisher.

Key files

• package_scripts/sign-windows.cjs — electron-builder sign hook (jsign)
• package.json — win.signtoolOptions, verifyUpdateCodeSignature
• .gitlab-ci.yml — .windows_sign template, release job wiring
• docker/Dockerfile — default-jre-headless for jsign (ci-builder:3.2)

Technical decisions

• Sign on Linux CI with jsign — no Windows runner required.
• Single Public Trust profile shared across beta and prod; creds via masked AZURE_* CI variables.
• Unsigned feat/snapshot builds keep CI fast and credential-free for day-to-day pipelines.

Known issues

• First install on a fresh machine may still show SmartScreen until reputation builds — signing removes the "unknown publisher" block.