Code signing

[Phoenix-]

Sign release builds (and the MSIX) so SmartScreen / Defender don't scare users away.

Status: cert NOT yet acquired. Two viable options, decision deferred.

Decision deferred until there's a first public release and the CI story is settled (both options below interact with those). Keeping both on the table.

Key facts (researched 2026-05-29)

• No certificate buys instant SmartScreen trust anymore — since ~Aug 2024 Microsoft treats OV == EV for SmartScreen. Reputation builds organically (several weeks + hundreds of clean installs) tied to a stable publisher identity. So: keep ONE identity across all releases; winget/Store distribution accelerates reputation (extra reason MSIX > Inno, see Installer (MSIX) #4).
• EV is pointless here — no SmartScreen benefit + unavailable to a bare individual.
• Azure Artifact Signing rejected — best tech (~$120/yr, cloud-HSM, no dongle, CI-friendly, MSIX-capable) BUT individual tier is US/CA-only → not available to this (non-US/CA) individual. (Org path covers EU/UK, but we sign as individual, not under Owlcat.)

Option A — Certum Open Source Code Signing

• OV-class, issued to a natural person (CN "Open Source Developer, ") → publisher shows YOUR name.
• $29 + a separate cryptoCertum card + reader ($50-70 one-time, non-refundable).
• USB hardware token only → signing is LOCAL & MANUAL, no CI auto-sign.
• No project-maturity requirements — buy and sign anything.

Option B — SignPath Foundation (free, OSS)

• $0. OV-class.
• ⚠️ Publisher identity is "SignPath Foundation", NOT your name — they hold the cert, vouch for your build. You inherit their shared SmartScreen reputation (could warm up faster), but lose name control.
• Signing only via their managed CI pipeline (key on their HSM) → requires a CI we don't have yet; no local manual signing.
• Eligibility: OSI-approved license, no proprietary components, actively maintained, already released in the form to be signed, functionality documented on the download page. ⚠️ Meridian has no public release yet → may not qualify until v1.0 ships.
• Apply via OSS Request Form emailed to SignPath.

Trade-off in one line

Certum = your name + local/manual + small cost, no maturity bar. SignPath = free + CI-auto + maybe faster warmup, but "SignPath Foundation" as publisher + needs a released project + needs CI.

Scope once a cert/path is chosen

• Signing flow: Certum → local signtool from the hardware token; SignPath → wire their CI action into releases.
• Sign the produced .msix (and portable artifacts), not raw nightly .exe.
• Document the process in notes/ so future-me doesn't relearn it.

Relationships

• Independent of Google OAuth verification (Google OAuth verification (exit test mode) #8). Google's reviewer never runs the binary — signing is purely a Windows distribution-UX concern; do not sequence it before Google OAuth verification (exit test mode) #8.
• Sign the installer from Installer (MSIX) #4 (MSIX), not raw .exe. (Installer (MSIX) #4 and Code signing #7 are otherwise DECOUPLED — signing is a last step over any artifact; MSIX is tested locally unsigned via a dev-cert meanwhile.)
• For nightlies right now: don't block on signing (wouldn't remove the warning anyway). A short README note on the SmartScreen "More info → Run anyway" step is enough.