Drop release code-signing; publish unsigned releases

Author: 26zl

.github/workflows/build.yml

@@ -744,45 +744,6 @@ jobs:
           name: please-tweak-windows-exe
           path: ./artifacts
 
-      - name: Sign release EXE (Authenticode)
-        if: steps.version.outputs.release == 'true'
-        run: |
-          if ([string]::IsNullOrWhiteSpace($env:CODE_SIGN_PFX_BASE64) -or
-              [string]::IsNullOrWhiteSpace($env:CODE_SIGN_PASSWORD)) {
-            Write-Error "The protected release environment must provide CODE_SIGN_PFX_BASE64 and CODE_SIGN_PASSWORD."
-            exit 1
-          }
-
-          $pfx = Join-Path $env:RUNNER_TEMP 'ptw-codesign.pfx'
-          try {
-            [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:CODE_SIGN_PFX_BASE64))
-            $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter signtool.exe |
-              Where-Object { $_.FullName -match '\\x64\\' } | Select-Object -Last 1
-            if (-not $signtool) { throw "signtool.exe not found on the runner" }
-
-            & $signtool.FullName sign /f $pfx /p $env:CODE_SIGN_PASSWORD /fd SHA256 `
-              /tr http://timestamp.digicert.com /td SHA256 "./artifacts/PleaseTweakWindows.exe"
-            if ($LASTEXITCODE -ne 0) { throw "signtool failed (exit $LASTEXITCODE)" }
-          }
-          finally {
-            Remove-Item $pfx -Force -ErrorAction SilentlyContinue
-          }
-        env:
-          CODE_SIGN_PFX_BASE64: ${{ secrets.CODE_SIGN_PFX_BASE64 }}
-          CODE_SIGN_PASSWORD: ${{ secrets.CODE_SIGN_PASSWORD }}
-        shell: pwsh
-
-      - name: Verify release signature
-        if: steps.version.outputs.release == 'true'
-        run: |
-          $signature = Get-AuthenticodeSignature "./artifacts/PleaseTweakWindows.exe"
-          if ($signature.Status -ne 'Valid') {
-            Write-Error "Release EXE is not validly Authenticode-signed: $($signature.StatusMessage)"
-            exit 1
-          }
-          Write-Host "[+] Valid release signature: $($signature.SignerCertificate.Subject)"
-        shell: pwsh
-
       - name: Create distribution package
         if: steps.version.outputs.release == 'true'
         run: |
@@ -833,7 +794,7 @@ jobs:
       - name: Generate SHA256SUMS
         if: steps.version.outputs.release == 'true'
         run: |
-          # Publish an archive checksum in addition to the EXE's Authenticode signature.
+          # Publish an archive checksum so downloads can be verified.
           $h = (Get-FileHash -Algorithm SHA256 -Path "PleaseTweakWindows.zip").Hash
           "$h  PleaseTweakWindows.zip" | Out-File -Encoding ascii -FilePath "SHA256SUMS.txt"
           Get-Content "SHA256SUMS.txt"

CONTRIBUTING.md

@@ -28,8 +28,7 @@ dotnet test PleaseTweakWindows.sln
 
 Production releases are created only from an explicit `v<Version>` tag. The tag must match
 `<Version>` in `PleaseTweakWindows.csproj`; ordinary pushes to `main` build and test but never publish.
-Tagged releases also require `CODE_SIGN_PFX_BASE64` and `CODE_SIGN_PASSWORD` secrets in the
-protected `release` environment; the workflow refuses to publish an unsigned EXE.
+Release EXEs are not code-signed; downloads are verified against the published `SHA256SUMS.txt`.
 
 ## Project Structure
 

README.md

@@ -16,9 +16,8 @@ This tool modifies Windows registry settings, services, and system configuration
 
 ## Verifying your download
 
-Releases through v2.1.2 were not Authenticode-signed. Starting with v2.1.3, the release workflow
-refuses to publish a tag unless the EXE has a valid Authenticode signature. Development artifacts
-may remain unsigned. Always verify the archive against the checksum from the same release:
+Releases are not code-signed, so Windows SmartScreen may warn the first time you run the EXE — that
+is expected. Verify the archive against the checksum published with the same release:
 
 ```powershell
 # Compare against SHA256SUMS.txt from the same release
@@ -117,7 +116,7 @@ Build.bat
 `Build.bat` runs `dotnet test` → `dotnet publish -c Release -r win-x64 --self-contained -p:PublishSingleFile=true` → packages the EXE, project notices, and dependency licenses under `dist\PleaseTweakWindows\` → zips it. Scripts are embedded inside the EXE; no loose `scripts\` folder ships with the release.
 
 This local package is unsigned. Production releases are created by the tagged GitHub Actions
-workflow, which requires and verifies the project code-signing certificate.
+workflow and are also unsigned; verify them against the published `SHA256SUMS.txt`.
 
 ## Logging & Privacy