Windows code signing (SignPath declined; OV cert at v1.0)

[Turbootzz]

Windows builds are unsigned, so SmartScreen warns on every Setup.exe download (README documents the "More info -> Run anyway" workaround). Paid certificates don't fit a hobby project; SignPath Foundation offers free code signing for open source projects, and rewynd meets the eligibility bar: OSI license (GPL-3.0, no dual licensing), public repo, released (beta.3), CI-built from source.

The certificate is issued in SignPath Foundation's name, which carries shared SmartScreen reputation, so the warning should disappear (or clear quickly) once releases are signed.

Plan

Now (before applying):

• Publish a code signing policy (SignPath requirement): team roles, review process, build provenance, privacy statement, SignPath attribution
• Link the policy from the README install section
• Verify 2FA on all accounts with repo access

Application:

• Apply at signpath.org (manual review, typically takes weeks; applying during beta so it lands before v1.0.0)

After approval (follow-up PR):

• Integrate signing into release.yml. SignPath signs submitted artifacts, while vpk pack wants to sign inline, so this is likely two-stage: sign rewynd.exe/rewynd-recorder.exe first, vpk pack, then sign Setup.exe (or use SignPath deep-signing on the package). Each release needs a manual approval in the SignPath portal.
• Update the README SmartScreen note

Interim: keep submitting each release Setup.exe to Microsoft Security Intelligence (WDSI) to speed up SmartScreen clearing.

Related: #103 (v1.0.0 distribution), #123 (winget; winget install avoids the mark-of-the-web SmartScreen prompt entirely).

[Turbootzz]

Status update: the SignPath Foundation application was declined for now — they want to see project popularity (GitHub stars and the like) before signing a project for free, or a paid plan. So the free-OSS route is parked until rewynd has more traction.

Revised plan:

• Sign at v1.0 (v1.0.0 distribution: installers + auto-updater (Windows Setup + Linux AppImage via Velopack, AUR, release CI) #103) with a paid OV certificate instead of waiting on SignPath. Certum's Open Source Code Signing cert (~€70/year, SimplySign cloud signing, publisher shows our own name) is the budget option that fits an EU hobby project. Since the 2024 change EV no longer gets an instant SmartScreen bypass, so a cheap OV cert is functionally equivalent: reputation accrues on the certificate and carries across releases. Note certificate validity is capped at ~15 months since March 2026, so it's effectively a yearly subscription.
• CI integration stays as planned, just simpler: with our own cert the release workflow signs rewynd.exe, rewynd-recorder.exe, Update.exe, rewynd-win-Setup.exe, and rewynd-win-Installer.exe directly (no external portal approval step).
• Interim: keep submitting each release to Microsoft Security Intelligence (WDSI), and ship winget (Distribute via native package managers (AUR, winget) #123) for technical users. Worth noting: in-app updates via Update.exe carry no mark-of-the-web, so existing users never see SmartScreen — the warning only hits the first Setup.exe/Installer.exe download. That limits the damage to new-user acquisition, which is also why signing can reasonably wait for v1.0.
• Re-apply at SignPath later if the project grows enough that free signing beats €70/year.

[Turbootzz]

Update from #217: Smart App Control blocked the beta.12 in-app update on a user's machine. The assumption above that updates never trigger a warning holds for SmartScreen (mark-of-the-web) but not for Smart App Control, which evaluates every executable and allows an unknown one only when it carries a valid signature. So signing cannot wait for v1.0 for the SAC-enabled part of the user base; free interim steps are a WDSI submission per release and a fresh SignPath Foundation application.