bug(windows): unsigned release binaries are blocked by Smart App Control — sign via Azure Artifact Signing (Thinkery AG) #1820

Summary

Released lean-ctx.exe binaries carry no Authenticode signature. On a clean Windows 11 install, Smart App Control (SAC) is enabled by default and blocks unsigned downloaded executables outright — with no "run anyway" path, unlike SmartScreen.

Reported by a community member; confirmed against release.yml.

Evidence

.github/workflows/release.yml builds and zips the Windows targets with no signing step:

line 275:  Compress-Archive -Path "rust/target/${{ matrix.target }}/release/lean-ctx.exe" ...

No signtool, no certificate, no signing service. (macOS is unsigned too, but Gatekeeper still offers an override, so the user impact is lower.)

Who this affects

Smart App Control only runs on clean Windows 11 installs — an in-place upgrade from Windows 10 leaves it off, and once a user disables it, it stays off until a reinstall. So this does not affect the existing Windows install base, which evidently works.

It does affect new users on new machines — precisely at first contact, before anyone knows whether the tool is worth any effort. The README promises "Get started (30 seconds)"; these users instead hit a security block.

Workarounds (now documented in the README)

• cargo install lean-ctx — builds locally; SAC treats a self-compiled binary far more leniently than a download.
• WSL — lean-ctx runs as a native Linux binary there; agents reach it via wsl lean-ctx mcp.
• Disabling SAC works but is a bad trade: system-wide, permanent, reversible only by reinstalling Windows. We should not recommend it.

Fix: Azure Artifact Signing, certificate issued to Thinkery AG

Switzerland is a supported country for Public Trust certificates, and there is a Switzerland North region (https://swn.codesigning.azure.net). The service was formerly called Trusted Signing.

This is preferred over the free SignPath Foundation route for three reasons:

The decisive point: a SignPath certificate may only sign the open-source project. Any Enterprise binary, installer or Windows package for paying customers needs our own certificate anyway — doing this twice is waste. Secondarily, the Windows signature dialog then reads Thinkery AG rather than a foundation's name.

What organisation validation requires

• Legal entity name exactly as registered — Thinkery AG
• Business identifier — the CHE/UID number
• Registered business address
• Website on a company-owned domain
• Two email addresses on a company-owned domain, both able to receive external links
• Individual identity validation by an authorised representative: government ID, via AU10TIX on a phone (QR code + Microsoft Authenticator)

Plus an Azure subscription and a Microsoft Entra tenant.

Processing time: 1–20 business days, longer if Microsoft requests further documents.

Two traps worth avoiding up front

1. Details must be exact. Per the docs, corrections after submission require an entirely new identity validation, which affects certificates already issued for signing.
2. Public records must be current. Microsoft reconciles against the commercial register. Supporting documents must have been issued within the last 12 months and remain valid for at least two more.

CI integration

• GitHub Action: azure/artifact-signing-action
• Endpoint must match the account's region exactly — a mismatch surfaces as 403 Forbidden with an internal SignerSign() failure
• Timestamping is mandatory, not optional: signing certificates are valid for only three days, so a signature without a timestamp stops validating almost immediately. Use http://timestamp.acs.microsoft.com/

Caveat

Signing alone does not clear Smart App Control immediately. SAC additionally weighs reputation, which accrues with distribution. Expect a lag after the first signed release.

Fallback

If the Azure route is rejected or stalls, SignPath Foundation remains available free of charge — Apache 2.0, public repo, 3,818 stars all satisfy their published criteria. The open question there is their "no commercial dual-licensing applied to any component" clause; it should be declared in the application rather than worked around, since they can revoke retroactively. Accepting also obliges us to publish a "Code signing policy" page, define Author/Reviewer/Approver roles, and approve every release manually.

Acceptance criteria

• Windows install section documents the SAC block and both clean workarounds
• Azure subscription + Entra tenant in place for Thinkery AG
• Organisation identity validation submitted (register details verified beforehand)
• Certificate profile created in Switzerland North
• Signing step in release.yml via azure/artifact-signing-action, with timestamping
• Verify a signed release actually passes Smart App Control on a clean Windows 11 VM