Oliver Kieselbach 7563435837 feat(ci): Authenticode-sign the bootstrap MSI and the runner it embeds (D-223) ...

MSI carries an Authenticode signature like any PE, so the same identity and the same
ordering rules apply: signing identity logs in first and only for the Key Vault token,
the storage login stays last, and no environment: on the job.

The embedded Invoke-BootstrapDownload.ps1 is signed BEFORE wix build -- wix embeds the
file as it finds it, so signing afterwards would leave the copy inside the MSI unsigned,
and a device under an AllSigned policy needs the runner to carry its own signature.

The MSI is signed after the build and before the hash and the upload, then both files are
verified (Valid, timestamped, optional publisher pin) while nothing is published yet.
The provenance attestation now also skips runs that upload nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-08 20:34:17 +02:00

..

assets

docs(readme): refresh screenshots, add social preview source

2026-09-03 14:50:19 +02:00

codeql

fix(security): resolve CodeQL log-forging findings and suppress by-design queries

2026-07-22 01:38:47 +02:00

ISSUE_TEMPLATE

docs(repo): AGPL-3.0 root license, MCP section in README, security policy and issue forms

2026-09-03 14:29:14 +02:00

scripts

fix(publish): read the signed bytes back as byte[], not as a wrapped Object[]

2026-09-08 18:54:36 +02:00

workflows

feat(ci): Authenticode-sign the bootstrap MSI and the runner it embeds (D-223)

2026-09-08 20:34:17 +02:00

dependabot.yml

changed dependabot to batching

2026-09-03 13:06:38 +02:00

FUNDING.yml

Update Buy Me a Coffee username in FUNDING.yml

2026-02-24 11:55:17 +01:00