{"id":50223730,"title":"Ask HN: Windows Signing for FOSS Projects","points":3,"user":"johnj-hn","time":1792865839,"time_ago":"12 hours ago","type":"link","content":"

Hey, all. I'm wondering how people handle signing packages for Windows when your project is open-source and there is no budget for an expensive code-signing certificate.

I thought I had found a solution with SignPath's (https://signpath.org/) free certs for open source, but I ran into two snags with them.

- I can't use custom runners in my github workflow. I was using a larger runner (still github hosted, I just picked a larger size) to run my tests faster, and SignPath failed the job because it didn't recognize the runner name. So I would have to go back to a standard runner with a name they recognize, which runs my tests about 3x slower.

- I have to approve each package signing, which means that a release process that was fully automated now has a step I have to manually approve.

I raised both of these issues with SignPath over a week ago, and I have yet to get a response, or to even have my signing certificate issued. So I'm about to give up on them.

Windows is only about 10% of my user base, so right now I'm leaning towards just continuing to not sign my Windows releases. But before I throw in the towel, I wanted to ask if anyone here knows of a better way to handle this.

Oh, and shameless plug for my project, a kubernetes management app: https://github.com/luxury-yacht/app/","url":"item?id=50223730","comments":[{"id":50224216,"level":0,"user":"mpd","time":1792869616,"time_ago":"11 hours ago","content":"

You can run tests and sign on different instances. I'm currently doing this with https://github.com/fixed-width/glass (see ci & release workflows)","comments":[]}],"comments_count":1}