fix(release): sign Windows ARM64 binaries for Smart App Control - #1410
Open
MAN$I VERMA (mansiverma897993) wants to merge 1 commit into
Open
fix(release): sign Windows ARM64 binaries for Smart App Control#1410MAN$I VERMA (mansiverma897993) wants to merge 1 commit into
MAN$I VERMA (mansiverma897993) wants to merge 1 commit into
Conversation
Release Windows ARM64 binaries were shipped unsigned, so Windows 11 Smart App Control / SmartScreen blocks the installer and the SDK DLLs (issue qualcomm#1398). Wire Authenticode signing into the release pipeline: - sign-windows job now signs every .exe/.dll in sdk-windows-arm64 and the installer with signtool (RFC3161 timestamping) using the WINDOWS_CODESIGN_PFX / WINDOWS_CODESIGN_PASSWORD secrets, and is a hard release gate: without a cert the job fails rather than shipping unsigned binaries. - add scripts/verify-windows-signatures.ps1 to assert every PE file has a Valid Authenticode signature; run it as a post-sign gate and re-upload the signed artifacts. - add scripts/test-verify-windows-signatures.ps1 self-test (signed + unsigned fixtures) wired into CI via signature-verify-test.yml. - update install / troubleshooting docs (en + cn) and notes/release.md. Signed-off-by: mansiverma897993 <vmansi756@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Windows Smart App Control / SmartScreen blocks GenieX because release Windows ARM64 binaries were shipped unsigned (Closes #1398).
This PR wires Authenticode signing into the release pipeline so every shipped Windows binary is signed and verified:
otes/release.md updated.
Test plan
elease.yml + signature-verify-test.yml
Closes #1398