Configure and verify production release signing

[dayflaree]

Objective

Configure and verify production release signing when real credentials or a managed signing service are available.

Background

Issue #129 now tracks unsigned-preview and provenance policy. This issue preserves the future real-signing work that cannot be completed without production credentials.

Required work

• Choose the signing path:
  • Windows Authenticode certificate/key material; or
  • managed signing service such as Microsoft Trusted Signing/Artifact Signing; and optionally
  • OpenPGP key for detached checksum signatures.
• Configure GitHub secrets/variables documented in docs/code-signing.md.
• Run a staging or public release with signing enabled.
• Verify signatures on Windows binaries and installers.
• Verify SHA256SUMS and SHA256SUMS.asc when present.
• Record signer identity/certificate publisher and OpenPGP fingerprint without exposing secrets.
• Update release docs if the actual signing path differs from the documented plan.

Acceptance criteria

• Signed artifacts are produced with real credentials.
• Verification commands and outputs are recorded.
• Secrets are not committed or exposed in logs.
• Release notes accurately state which artifacts are signed.
• Unsigned artifacts, if any, are explicitly listed.

Non-goals

• Do not use test keys as production evidence.
• Do not fabricate signature output.
• Do not claim Windows reputation/SmartScreen status unless separately verified.

[dayflaree]

Blocker status checked after completing all currently actionable tickets.

Result

This remains open. Production release signing is still future work because no production Windows Authenticode certificate, OpenPGP release key, Ed25519 production update-signing key, or managed signing service was available or used.

Commands run

cd /home/elijah/projects/sourceweaver
git status --short --branch
gh issue view 143 --repo dayflaree/sourceweaver --json number,title,state,body,labels,comments
date -Iseconds
git rev-parse HEAD
gh release view v0.1.0-preview.1 --repo dayflaree/sourceweaver --json tagName,isDraft,isPrerelease,url,assets
env | cut -d= -f1 | rg '^SOURCEWEAVER_(WINDOWS_SIGNING|GPG|UPDATE_SIGNING)' || true
command -v signtool || true
command -v osslsigncode || true
command -v gpg || true
rg -n "Production signing|production signing|Windows Authenticode|OpenPGP|Signed update manifest|Unsigned preview|#143|not production-signed|absent" docs/code-signing.md docs/release.md CHANGELOG.md README.md

Evidence

• Repository status before check: clean on main tracking origin/main.
• The public preview release v0.1.0-preview.1 exists and is marked prerelease.
• Release notes and signing docs state the preview release is unsigned and that production signing remains future work.
• No local production signing environment variable names matching SOURCEWEAVER_WINDOWS_SIGNING*, SOURCEWEAVER_GPG*, or SOURCEWEAVER_UPDATE_SIGNING* were present in the local shell output.
• No SignTool or osslsigncode command was available locally. gpg availability alone is not production release-signing evidence.

Blocker log:

97f37cb5deaec36883e2de0f5d430ab8c9753455384e29b540680dc7947089bd  /tmp/sourceweaver-issue143-blocker-check.log

Required evidence to close later

• Real production signing credentials or managed signing service.
• Signed release run using those credentials.
• Authenticode verification output for Windows artifacts when Windows signing is configured.
• OpenPGP verification output for SHA256SUMS.asc when checksum signing is configured.
• Signed update manifest verification output when the production Ed25519 update key is configured.
• Release URL, workflow URL, artifact hashes, public key/certificate identity, rotation/escrow notes, and secret-handling boundary.

Redistribution and legal boundary

No private signing keys, certificates, passphrases, managed signing credentials, production signatures, or private signing logs were committed or redistributed. This comment records the blocker and leaves the future-certification ticket open.

[dayflaree]

Completion-plan dependency update

This ticket is now part of the Completion certification and production readiness milestone.

Dependencies to close first or complete alongside this issue:

• Provision production signing credentials and repository secrets #158 — provision production signing credentials and repository secret/variable configuration.
• Add external certification evidence bundle validator #160 — validate the evidence bundle shape before closure.
• Publish final completion release after external certifications #161 — consumes this issue's evidence in the final completion release.

Closure path:

1. Use Provision production signing credentials and repository secrets #158 to choose and configure the production signing path without exposing private material.
2. Run a signed release or signing dry run according to the selected path.
3. Verify Windows artifact signatures, checksum signatures, update manifest signatures, SBOM, provenance, and attestations.
4. Post certificate/key fingerprints, public verification commands, artifact hashes, workflow URL, and legal boundary here.
5. Update docs/release/signing material in a commit, run the full local gate, push, wait for green CI, then close.

[dayflaree]

Tracker update from the 2026-08-08 full review:

This ticket is now active completion-certification work rather than a future placeholder. It remains blocked by #158 and should also wait for #162, because the release workflow needs final-release hardening before production signing can be considered final-release ready.

Completion evidence should include: secret names only; signing policy; timestamp URL; Windows signature verification output; checksum signature verification output if OpenPGP checksums are required; update manifest signature verification if update manifests are required; artifact hashes; CI/release URLs; and a secret-handling boundary confirming no credential values were printed or committed.