bingshuo/guanghu
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity
guanghu/docs/adr/0139-temporary-windows-authenticode-soft-gate.md
Guanghu Domestic Migration 9b41d51231
Some checks are pending
Auto-update PR branches / Update open PR branches (push) Waiting to run
Details
CI / Frontend Static Quality Checks (push) Waiting to run
Details
CI / Frontend Tests & Coverage (push) Waiting to run
Details
CI / Rust Tests & Quality Checks (push) Waiting to run
Details
CI / Linux build verification (push) Waiting to run
Details
Deploy docs / Build VitePress site (push) Waiting to run
Details
Deploy docs / Deploy to GitHub Pages (push) Blocked by required conditions
Details
Release (Alpha) / Compute alpha version (push) Waiting to run
Details
Release (Alpha) / Build release artifacts (push) Blocked by required conditions
Details
Release (Alpha) / GitHub Release (alpha) (push) Blocked by required conditions
Details
Release (Alpha) / Update docs and release pages (push) Blocked by required conditions
Details
chore: import sanitized domestic snapshot for REPO-004 
Source snapshot: 514ab1975951d94342ea38e64101d5a0f1c51c77
2026-07-17 15:55:28 +08:00

1.7 KiB
Raw Blame History

type, id, title, status, date, supersedes, amends
type id title status date supersedes amends
ADR 0139 Temporary Windows Authenticode soft gate active 2026-06-09 0138 0130

Context

ADR 0138 made Authenticode mandatory for every Windows release artifact. That is the desired end state, but the repository still does not have a trusted Windows code-signing certificate or signing service configured. Enforcing Authenticode before provisioning is complete blocks the alpha and stable release pipelines even though the Tauri updater signatures are available and still protect updater integrity.

Decision

Windows Authenticode signing is temporarily optional for both alpha and stable release builds.

  • Windows builds still require TAURI_SIGNING_PRIVATE_KEY and TAURI_KEY_PASSWORD, so updater artifacts remain signed.
  • When WINDOWS_CODE_SIGNING_CERTIFICATE/WINDOWS_CERTIFICATE and the matching password secret are present, CI imports the certificate, builds with the generated Authenticode config, and verifies executable and installer signatures with Get-AuthenticodeSignature.
  • When both Windows Authenticode certificate and password secrets are absent, CI emits a warning and builds Windows artifacts without Authenticode.
  • Partial Authenticode configuration remains a hard error because it is ambiguous and easy to misread as a signed release.

Consequences

Windows releases can continue while certificate provisioning is pending. This does not provide the Windows publisher identity needed by SmartScreen, Smart App Control, Defender, or WDAC-managed environments; those policies can still block the installer until a trusted Authenticode certificate or signing service is configured. Reinstating a hard gate should be a small workflow change once the certificate path exists.