Alex Vanderveen 3d9930c5d3 release: Authenticode-sign Windows binaries when a certificate secret exists ...

Smart App Control blocks unsigned executables outright. The packager now
runs tools/ci/sign_windows.sh over the staged tree (host exe, DLLs,
emitters) with SHA-256 + RFC 3161 timestamp; no certificate in the
environment means a notice and an unsigned package as before, while a
configured certificate that fails to sign is fatal. The workflow template
passes WINDOWS_SIGN_PFX_BASE64 / WINDOWS_SIGN_PFX_PASSWORD to the package
step. Docs cover the secrets and the limit: the game exe the player builds
locally after Generate is unsigned by nature.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1dT6h1ZshMVUUVKTPxsCD

2026-09-06 03:31:38 -04:00

..

build_emitters.sh

rollback patches

2026-08-01 14:13:58 -04:00

check_boot_exe.sh

self-build: loop breaker, install-folder preflight, boot-EXE name lint

2026-09-01 11:00:29 -04:00

clear_generated.sh

rollback patches

2026-08-01 14:13:58 -04:00

normalize_version.sh

auto versioning CI releases

2026-08-11 22:05:20 -04:00

prefetch_sdl3.sh

project studio, harden prefetch sdl3

2026-08-12 16:49:03 -04:00

record_pins.sh

Integrate retcomm-rbengine as shared rollback host policy.

2026-08-11 23:52:31 -04:00

sign_windows.sh

release: Authenticode-sign Windows binaries when a certificate secret exists

2026-09-06 03:31:38 -04:00

vendor_deps.sh

tools: keep vendor deps help to documented usage

2026-08-25 11:58:22 -07:00

verify_pins.sh

Integrate retcomm-rbengine as shared rollback host policy.

2026-08-11 23:52:31 -04:00