Signed Windows Binaries

[chris-morrell]

Enterprise malware scans flag black.exe and blackd.exe due to neither binary being signed. This can be checked/verified via AuthenticodeSignature baked into Windows:

AuthenticodeSignature -FilePath black.exe


    Directory: ${super long directory}


SignerCertificate                         Status                                        Path
-----------------                         ------                                        ----
                                          NotSigned                                     black.exe

Can the distributed binaries be signed by a certificate from a recognized CA? It appears that there are some cheap CAs catering to open-source projects.

[cooperlees]

Not many of us are Windows users, are there any docs to sign our binaries via GitHub Actions?

[rdrll]

There seem to be a GitHub Action available for code signing https://github.com/marketplace/actions/code-sign-a-file. It works on windows-2019, and can sign executables with .pfx certificate.

[bariod]

Defender detected it as a trojan today: