Skip to content
The Handover

Services

Windows code signing

What we tell an AI agent working on a project that uses Windows code signing —1 rule.

Build a rootnote set for a Windows code signing projectPlain text

Windows code signing did not publish a file for agents when we last checked, so this page is the only agent-facing guidance for it we know of. Why that matters.

Everything here is general guidance: rules an agent knows but does not reliably follow. We have not been caught out by Windows code signing ourselves, and this page does not pretend otherwise.

Windows signing: sign every executable, timestamp it, and expect early warnings

General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-18

  • Sign the installer and every executable it installs, not just the installer.
  • Timestamp every signature. Without it the signature stops validating when the certificate expires, and every existing install starts warning.
  • Do not conclude signing failed because SmartScreen still warns. Reputation builds over time for a new certificate or file.
  • Keep signing credentials out of the repository and out of any build that runs on an untrusted pull request.

Others answering the same question

Apple code signing and notarisation