Release installers are currently unsigned, so Windows SmartScreen warns on first run. Add Authenticode code signing for the engine, the app, and the NSIS installers.
Plan
- Sign via a cloud-held code-signing certificate (DigiCert Software Trust Manager / KeyLocker) from CI, so no hardware token is needed and it works under the publisher identity.
- The release pipeline is prepared and self-enabling once the signing credentials are configured; a post-build step verifies each published installer is actually signed.
Status
Pipeline landed on main (27b9f36). Remaining: configure the signing credentials, then the next tagged release is signed and verified automatically.
Release installers are currently unsigned, so Windows SmartScreen warns on first run. Add Authenticode code signing for the engine, the app, and the NSIS installers.
Plan
Status
Pipeline landed on
main(27b9f36). Remaining: configure the signing credentials, then the next tagged release is signed and verified automatically.