chore: set up code signing for releases

[nextestudios]

Summary

Sign the installer and portable executable (e.g. an open-source signing service) so SmartScreen warnings decrease.

Motivation

Unsigned binaries trigger SmartScreen; docs/CODE_SIGNING.md already states the policy.

Requirements

• Only tag builds signed, from CI; certificate never stored in the repository; manual approval step.
• Verify Authenticode in the release workflow before publishing.

Controller UX

N/A.

Technical Notes

Release workflow step similar to the existing manifest signing.

Acceptance Criteria

• Published binaries have a valid Authenticode signature.

Testing

Release workflow verification.

Dependencies

• None

---

Priority: medium · Milestone: 9 · 1.0 Readiness

[nextestudios]

The signing plumbing is merged in #154, but releases stay unsigned until a certificate is configured. I'm leaving this issue open until then.

Already in place

• release.yml signs ControlFS.exe (before Inno Setup packages it), the installer and the portable exe, all timestamped. Only tag builds are signed. It then checks the Authenticode signatures (valid + timestamped) after the launch smoke tests and before publishing. If no secrets are configured, the release goes out unsigned as before, with a warning. A half-finished configuration fails the release.
• The job runs in the GitHub environment release, which lets you add manual approval.
• Tested once with a self-signed test certificate on the runner: all three files were signed and verified, and the signed apps launched.

What the maintainer needs to provide (step by step in docs/build-and-release.md → "Assinatura de código")

1. Manual approval: Settings → Environments → release (it's created automatically on the next release run, or create it now). Add yourself under Required reviewers. Under Deployment branches and tags, allow tags v* and branch main.
2. A certificate, via one of these two options. Put the values in the release environment, not in repository secrets:
   • Option A (recommended): Microsoft Artifact Signing (formerly Trusted Signing). You need an Azure subscription, an Artifact Signing account with identity validation done, and a Public Trust certificate profile. You also need an Entra app registration with a client secret and the Artifact Signing Certificate Profile Signer role on that account.
     • Variables: ARTIFACT_SIGNING_ENDPOINT (e.g. https://eus.codesigning.azure.net), ARTIFACT_SIGNING_ACCOUNT, ARTIFACT_SIGNING_PROFILE
     • Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
   • Option B: an exportable .pfx (e.g. from an open-source signing program).
     • Secrets: SIGNING_PFX_BASE64 (the .pfx in Base64) and SIGNING_PFX_PASSWORD
     • Optional variable: SIGNING_TIMESTAMP_URL (default http://timestamp.digicert.com)
3. On the next release, check the log for "Release será assinada (provedor: …)" and the "Authenticode OK" lines. Then update docs/CODE_SIGNING.md, which still says releases are unsigned, and close this issue.

Not covered yet: the Inno Setup uninstaller (unins000.exe) is not signed.

[nextestudios]

Status: the maintainer applied for SignPath Foundation's free OSS code signing on 2026-09-27. The repository meets the published conditions (code signing policy in README and release notes, team roles, privacy policy in docs/PRIVACY.md, builds only from GitHub Actions). Next step after acceptance: add the SignPath signing step to release.yml using the organization/project identifiers and an API token stored as Actions secrets in the release environment, then close this issue after the first signed release is verified.