Sign the Windows installer (Authenticode) to stop SmartScreen warnings

Problem

The Windows installer built by .github/workflows/release-installers.yml (iscc qtpass.iss) is not Authenticode-signed. There is no signtool step and no certificate in the repository secrets.

Consequence for users: on first run Windows shows the SmartScreen dialog "Windows protected your PC" and the installer only runs after More info → Run anyway. SmartScreen reputation is built per file hash, so every new release starts nagging again.

Unlike the macOS situation (#1542) nothing is blocked: Chocolatey (1.7.0, approved, tests passing) and winget (1.7.0) both accept unsigned installers. This is a polish/trust issue, not a distribution outage.

Options

SignPath Foundation (recommended) — free Authenticode code signing for open source projects. Certificate stays in their HSM; signing happens from CI via the signpath/github-action-submit-signing-request action. Cost: €0. Needs an application and approval (takes a few weeks), then one extra step in release-installers.yml.
https://signpath.org/
Azure Trusted Signing — ~USD 10/month. Requires an organisation with ≥3 years of verifiable history (IJHack as a registered stichting should qualify). CI via azure/trusted-signing-action.
Own OV/EV certificate — €150–300/year, and since 2023 the private key must live on a hardware token or HSM, which makes unattended CI signing painful. Not recommended.

Plan

Status 2026-10-11: test-certificate signing works from main; waiting for the SignPath Foundation's review and the production certificate.

Your SignPath Foundation application

Hi Anne Jan,

thank you for submitting your OSS Request Form and for sharing your project with us.
We are currently reviewing your project with a focus on security-related aspects and the project's reputation.
Once this assessment is complete, we will get back to you with the outcome.

We provide a free code signing certificate (issued to our “SignPath Foundation”) and offer our service for free to open source projects.
Due to the certificate being issued to our organization, we need to verify that the binary artifact is built solely from the source code in the public repository.
We therefore integrate with CI services and check the configuration.
Currently, AppVeyor, GitHub Actions and GitLab are supported.

If everything is in order and eligible, we can proceed to create a subscription/OSS organization for your project in SignPath, complete with a test certificate.
After the technical setup and origin verification have been successfully completed, we can then order and import the production (release) certificate into your subscription.

Thank you for your patience, and we look forward to collaborating with you.

Best regards,
Phillip

Code signing policy page (SignPath Foundation)

Sign the Windows release through the SignPath Foundation (#1977)

Reopened: the merge of #1977 closed this automatically, because its description said "closes #1643 once the production certificate is in" and GitHub only reads the keyword. It stays open until the first release is signed with the production certificate; see the checklist in the description.

Code signing policy: status per platform, macOS included

ROADMAP.md: where QtPass is heading (#1992)

Navigation Menu

Repository navigation

Sign the Windows installer (Authenticode) to stop SmartScreen warnings #1643

Problem

Options

Plan

Related

Your SignPath Foundation application

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Sign the Windows installer (Authenticode) to stop SmartScreen warnings #1643

Description

Problem

Options

Plan

Related

Activity

annejan commented on Sep 13, 2026

annejan commented on Sep 16, 2026

Your SignPath Foundation application

annejan commented on Oct 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions