Make signed releases

[mcmilk]

It would be really nice, if we can find some way to create signed releases again.

[bearonion]

SignPath Foundation provides code signing for open source projects.

[mcmilk]

SignPath Foundation provides code signing for open source projects.

This project seems to be right one to use.

[DraftingDreamer]

Another data point in support of signed releases:

The 26.02 x64 installers are currently being flagged by Microsoft Defender — Trojan:Win32/Suschil!rfn on 7z26.02-zstd-x64.exe and 7z26.02-zstd-x64-ndm.exe (VirusTotal also shows a few dozen engines flagging, virtually all with generic ML/reputation verdicts: https://www.virustotal.com/gui/file/e6b3728f0ed2f6fd9f18c11d793ff67a8b1553555f1f8d9b916fe2e7f748ae27).

I verified the downloaded assets match the official release digests (SHA-256 e6b3728f…ae27 / 57b8c82c…5c19), so this is purely a reputation issue with the unsigned installers, as discussed here. I've submitted a false-positive report to Microsoft for both files in the meantime.

Until signing is in place, this cycle seems to repeat with every release (#451, #507, #508, #509), so a signed installer would help a lot. Thanks for maintaining this project!

[sebres]

this is purely a reputation issue with the unsigned installers

I don't think it is... It is some heuristic detecting some installer piece of code as "known" as malicious. It would also happen for signed installer as well unless the heuristic would be disabled for signed binaries (and I guess it would not, at least till it'd build a perfectly positive reputation over time).

[sebres]

Until signing is in place, this cycle seems to repeat with every release

Or MS would learn someday, that installers built on GHA by regular way shall not be detected as malware, especially if people start submit the files as incorrectly classified as malware via special MS-form - https://www.microsoft.com/en-us/wdsi/filesubmission .