enhance: add code signing steps and documentation for Windows artifacts

- Introduced optional code signing steps in the GitHub Actions workflow for the engine, dashboard, and installer.
- Updated building.md to include details on obtaining a code signing certificate and the importance of signing for Windows SmartScreen.
- Enhanced the installer script with additional metadata fields for better user experience and support.

Author: AsieduDevelopmentHub

.github/workflows/release.yml

@@ -173,6 +173,21 @@ jobs:
           Copy-Item $cfg "dist\engine-config.json" -Force
           Write-Host "engine-config.json -> Release + dist"
 
+      - name: Code sign engine + dashboard (optional)
+        shell: pwsh
+        env:
+          WINDOWS_CODESIGN_PFX_BASE64: ${{ secrets.WINDOWS_CODESIGN_PFX_BASE64 }}
+          WINDOWS_CODESIGN_PFX_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_PFX_PASSWORD }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CODESIGN_PFX_BASE64)) {
+            Write-Host "Skipping Authenticode signing (set repo secret WINDOWS_CODESIGN_PFX_BASE64 + WINDOWS_CODESIGN_PFX_PASSWORD; see docs/architecture/building.md)."
+            exit 0
+          }
+          $pfxPath = Join-Path $env:RUNNER_TEMP "sentracore-codesign.pfx"
+          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_CODESIGN_PFX_BASE64))
+          & ".\scripts\sign-windows-artifacts.ps1" -PfxPath $pfxPath -RepoRoot (Get-Location).Path
+          Remove-Item -LiteralPath $pfxPath -Force
+
       - name: Install Inno Setup
         shell: pwsh
         run: |
@@ -186,6 +201,21 @@ jobs:
           & $iscc "installer\\sentracore.iss"
           Get-ChildItem "dist" -Filter "SentraCore_Setup_v*.exe" | Select-Object -First 1 | ForEach-Object { $_.FullName }
 
+      - name: Code sign installer (optional)
+        shell: pwsh
+        env:
+          WINDOWS_CODESIGN_PFX_BASE64: ${{ secrets.WINDOWS_CODESIGN_PFX_BASE64 }}
+          WINDOWS_CODESIGN_PFX_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_PFX_PASSWORD }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CODESIGN_PFX_BASE64)) {
+            Write-Host "Skipping installer signing (same secrets as engine/dashboard step)."
+            exit 0
+          }
+          $pfxPath = Join-Path $env:RUNNER_TEMP "sentracore-codesign-installer.pfx"
+          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_CODESIGN_PFX_BASE64))
+          & ".\scripts\sign-windows-artifacts.ps1" -PfxPath $pfxPath -RepoRoot (Get-Location).Path -InstallerOnly
+          Remove-Item -LiteralPath $pfxPath -Force
+
       - name: Upload installer artifact
         uses: actions/upload-artifact@v4
         with:

docs/architecture/building.md

@@ -224,7 +224,7 @@ Install:
 
 Official website:
 
-[Inno Setup](https://jrsoftware.org/isinfo.php?utm_source=chatgpt.com)
+[Inno Setup](https://jrsoftware.org/isinfo.php)
 
 ---
 
@@ -240,6 +240,32 @@ The installer may:
 
 ---
 
+## Windows SmartScreen and "Unknown publisher"
+
+Windows Defender SmartScreen and the UAC prompt show **Unknown publisher** when the installer (or the executables inside it) are **not signed** with a **publicly trusted** Authenticode (code signing) certificate.  
+`AppPublisher` and related Inno Setup fields improve **Add/Remove Programs** and installer metadata, but they **do not** replace a digital signature.
+
+What actually fixes the warning:
+
+1. Obtain a **code signing certificate** from a CA that chains to the Microsoft Trusted Root Program (for example standard **OV** or **EV** code signing). **EV** certificates are often associated with faster SmartScreen reputation for brand-new binaries.
+2. Sign **`SentraCoreEngine.exe`**, **`sentracore_dashboard.exe`**, and the **setup `.exe`** with `signtool` (Windows SDK), including an **RFC 3161 timestamp** so signatures stay valid after the cert expires.
+3. For releases built in GitHub Actions, add repository secrets (see below) so the workflow can sign before uploading artifacts.
+
+Local signing (PFX on your machine):
+
+```powershell
+$env:WINDOWS_CODESIGN_PFX_PASSWORD = '<your-pfx-password>'
+.\scripts\sign-windows-artifacts.ps1 -PfxPath C:\path\to\codesign.pfx
+# After Inno Setup produces dist\SentraCore_Setup_v*.exe:
+.\scripts\sign-windows-artifacts.ps1 -PfxPath C:\path\to\codesign.pfx -InstallerOnly
+```
+
+GitHub Actions (optional): create secrets **`WINDOWS_CODESIGN_PFX_BASE64`** (base64-encoded `.pfx` file) and **`WINDOWS_CODESIGN_PFX_PASSWORD`**. When `WINDOWS_CODESIGN_PFX_BASE64` is set, the release workflow signs the engine and dashboard before packaging, then signs the installer afterward. Protect these secrets with restricted **environments** / branch policies where possible.
+
+References: [Microsoft: Sign Windows apps](https://learn.microsoft.com/en-us/windows/win32/appxpkg/how-to-sign-a-package-using-signtool), [Introduction to code signing](https://learn.microsoft.com/en-us/windows/win32/seccrypto/cryptography-tools).
+
+---
+
 # Recommended Packaging Workflow
 
 ```text
@@ -288,6 +314,7 @@ Before publishing a release, verify:
 - notifications operate correctly
 - installer shortcuts work
 - uninstall removes runtime artifacts cleanly
+- Windows release: setup and shipped `.exe` files show a trusted publisher after code signing (see **Windows SmartScreen and "Unknown publisher"** above)
 
 ---
 

installer/sentracore.iss

@@ -2,6 +2,12 @@
 AppName=SentraCore
 AppVersion=0.0.1
 AppPublisher=SentraCore Development Team
+AppPublisherURL=https://github.com/AsieduDevelopmentHub/SentraCore
+AppSupportURL=https://github.com/AsieduDevelopmentHub/SentraCore/issues
+AppUpdatesURL=https://github.com/AsieduDevelopmentHub/SentraCore/releases
+AppCopyright=Copyright (C) SentraCore contributors
+; "Unknown publisher" in Windows SmartScreen is resolved by Authenticode signing
+; (see docs/architecture/building.md), not by metadata alone.
 DefaultDirName={autopf}\SentraCore
 DefaultGroupName=SentraCore
 OutputDir=..\dist

scripts/sign-windows-artifacts.ps1

@@ -0,0 +1,138 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Authenticode-sign SentraCore Windows binaries and the Inno Setup installer.
+
+.DESCRIPTION
+  Use after building the engine (dist\SentraCoreEngine.exe), the Flutter Windows
+  release (dashboard\build\windows\x64\runner\Release\sentracore_dashboard.exe),
+  and optionally after ISCC produces dist\SentraCore_Setup_v*.exe.
+
+  Signing requires a code-signing certificate trusted by Windows (public CA).
+  Self-signed certificates will NOT remove SmartScreen warnings for end users.
+
+.PARAMETER PfxPath
+  Path to a .pfx (PKCS#12) file containing the signing certificate and private key.
+
+.PARAMETER PfxPassword
+  Password for the PFX file. Avoid passing on the command line in shared logs;
+  prefer environment variable WINDOWS_CODESIGN_PFX_PASSWORD.
+
+.PARAMETER TimestampServer
+  RFC3161 timestamp authority (SHA-256). Default: DigiCert public TSA.
+
+.EXAMPLE
+  .\scripts\sign-windows-artifacts.ps1 -PfxPath C:\certs\codesign.pfx
+
+.EXAMPLE
+  $env:WINDOWS_CODESIGN_PFX_PASSWORD = '***'
+  .\scripts\sign-windows-artifacts.ps1 -PfxPath C:\certs\codesign.pfx -SignInstaller
+
+.EXAMPLE
+  .\scripts\sign-windows-artifacts.ps1 -PfxPath C:\certs\codesign.pfx -InstallerOnly
+#>
+param(
+  [Parameter(Mandatory = $true)]
+  [string] $PfxPath,
+
+  [string] $PfxPassword = "",
+
+  [string] $TimestampServer = "http://timestamp.digicert.com",
+
+  [string] $Description = "SentraCore",
+
+  [string] $RepoRoot = "",
+
+  [switch] $SignInstaller,
+
+  [switch] $InstallerOnly
+)
+
+$ErrorActionPreference = "Stop"
+
+if (-not $RepoRoot) {
+  $RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+}
+
+$pfxPasswordEffective = $PfxPassword
+if (-not $pfxPasswordEffective -and $env:WINDOWS_CODESIGN_PFX_PASSWORD) {
+  $pfxPasswordEffective = $env:WINDOWS_CODESIGN_PFX_PASSWORD
+}
+if (-not (Test-Path -LiteralPath $PfxPath)) {
+  throw "PFX not found: $PfxPath"
+}
+
+function Find-SignTool {
+  $roots = @(
+    "${env:ProgramFiles(x86)}\Windows Kits\10\bin",
+    "${env:ProgramFiles}\Windows Kits\10\bin"
+  )
+  foreach ($root in $roots) {
+    if (-not (Test-Path $root)) { continue }
+    $candidates = Get-ChildItem -Path $root -Recurse -Filter "signtool.exe" -ErrorAction SilentlyContinue |
+      Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
+      Sort-Object { $_.DirectoryName } -Descending
+    if ($candidates) {
+      return $candidates[0].FullName
+    }
+  }
+  throw "signtool.exe not found. Install the Windows SDK (Desktop development with C++ / Windows SDK)."
+}
+
+function Invoke-SignFile {
+  param(
+    [string] $SignTool,
+    [string] $FilePath,
+    [string] $Pfx,
+    [string] $Pass,
+    [string] $Tsa,
+    [string] $Desc
+  )
+  if (-not (Test-Path -LiteralPath $FilePath)) {
+    Write-Warning "Skip (missing): $FilePath"
+    return
+  }
+  $full = (Resolve-Path -LiteralPath $FilePath).Path
+  Write-Host "Signing: $full"
+  $argList = @(
+    "sign",
+    "/f", $Pfx,
+    "/tr", $Tsa,
+    "/td", "sha256",
+    "/fd", "sha256",
+    "/d", $Desc
+  )
+  if ($Pass) {
+    $argList += @("/p", $Pass)
+  }
+  $argList += $full
+  & $SignTool @argList
+  if ($LASTEXITCODE -ne 0) {
+    throw "signtool failed with exit $LASTEXITCODE for $full"
+  }
+}
+
+$signTool = Find-SignTool
+Write-Host "Using: $signTool"
+
+$engine = Join-Path $RepoRoot "dist\SentraCoreEngine.exe"
+$dashboard = Join-Path $RepoRoot "dashboard\build\windows\x64\runner\Release\sentracore_dashboard.exe"
+
+if (-not $InstallerOnly) {
+  Invoke-SignFile -SignTool $signTool -FilePath $engine -Pfx $PfxPath -Pass $pfxPasswordEffective -Tsa $TimestampServer -Desc $Description
+  Invoke-SignFile -SignTool $signTool -FilePath $dashboard -Pfx $PfxPath -Pass $pfxPasswordEffective -Tsa $TimestampServer -Desc $Description
+}
+
+if ($SignInstaller -or $InstallerOnly) {
+  $setup = Get-ChildItem -Path (Join-Path $RepoRoot "dist") -Filter "SentraCore_Setup_v*.exe" -ErrorAction SilentlyContinue |
+    Sort-Object LastWriteTime -Descending |
+    Select-Object -First 1
+  if ($setup) {
+    Invoke-SignFile -SignTool $signTool -FilePath $setup.FullName -Pfx $PfxPath -Pass $pfxPasswordEffective -Tsa $TimestampServer -Desc "$Description Installer"
+  }
+  else {
+    Write-Warning "No dist\SentraCore_Setup_v*.exe found to sign."
+  }
+}
+
+Write-Host "Done."