ThreadPilot releases are currently unsigned. An application for SignPath Foundation code signing is pending; the release workflow remains fully automated and unchanged until the project is approved.
- Sign the published executable and installer with Authenticode through SignPath.
- Use the publisher identity assigned by SignPath Foundation.
- Submit signing requests only from the protected GitHub release workflow.
- Keep SignPath project identifiers and organization secrets in GitHub environment secrets.
- Require an explicit SignPath approval when the selected policy requires it.
Signing will be inserted between artifact creation and checksum generation. Builds, tests, packaging, GitHub Release creation, and artifact upload remain automated; no private certificate or PFX will be stored in the repository or on a GitHub runner.
- Complete the SignPath Foundation application.
- Wait for approval and the SignPath organization/project invitation.
- Configure the SignPath project and trusted build policy.
- Add the identifiers and token supplied by SignPath as protected GitHub secrets.
- Integrate signing on a separate change and test it with a prerelease tag.
- Verify the Authenticode publisher, timestamp, checksums, and installer before publishing a stable release.
Until those steps are complete, release artifacts must be described as unsigned. Do not enable the legacy PFX signing path without a separately acquired certificate and a reviewed secret-storage procedure.
Get-AuthenticodeSignature .\ThreadPilot.exe
Get-FileHash .\ThreadPilot.exe -Algorithm SHA256See the public code-signing policy for scope, approvals, and incident handling.