[mgradwohl]

Description

The hand backport of #2944 to release/0.9, for v0.9.1. It's git cherry-pick -x 572e115b (#2944's squash commit on main) with the conflicts resolved by hand. The backport action can't push workflow changes, so this one wasn't opened automatically. A tag runs the release.yml at the tagged commit, so release/0.9 needs this file for v0.9.1 to be signed.

Branch name: this branch is called candidate/azure-signing-2302-0.9 only so that its dry run can enter the release-signing environment and really sign. That environment admits only v* tags and the main, release/* and candidate/* branches.

Brought over from #2944, unchanged:

• sign-windows runs on windows-2025 in environment: release-signing. It signs in with azure/login at tenant level (allow-no-subscriptions: true, with client-id/tenant-id from the environment's secrets, over OIDC). It then signs TaskSmack.exe and TaskSmackHelper.exe from both the x64 and the ARM64 .zip with azure/artifact-signing-action, writes each signed exe back over its own entry in its .zip, and checks that only those entries changed.
• Pins: the same SHAs as main:
  • azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
  • azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
• Gating:
  • SIGNING_ENABLED is defined once, by ref (v* tags, main, release/*, candidate/*), and reaches job if:s through validate's signing output.
  • The [BUG] release.yml: a real release can be signed under the test-signing policy once SIGNPATH_SIGNING_ENABLED is set; fail closed #2745 guard: validate refuses a real release that would be unsigned.
  • matrix.signed is gone: both architectures sign.
• Signer:
  • WINDOWS_EXPECTED_SIGNER: 'Matt Gradwohl', and the TASKSMACK_EXPECTED_SIGNER default in cmake/Options.cmake is Matt Gradwohl.
  • cmake/VerifyWindowsSignatures.cmake now requires the same subject, not the same thumbprint.
  • cmake/CPackProjectConfig.cmake.in is updated to match.
• SignPath retired: SIGNPATH_SIGNING_POLICY, vars.SIGNPATH_SIGNING_ENABLED, the SignPath action and steps, and the test-signing trust step are all gone. grep -rn 'SIGNPATH\|SignPath\|test-signing\|SigningPolicy' .github cmake tools docs CONTRIBUTING.md README.md tasksmack.md finds nothing.
• Docs: CONTRIBUTING.md's Windows code signing section, README, docs/code-signing-policy.md, the User Guide's Verifying a Release section, the FAQ and tasksmack.md. All of these exist on release/0.9, and each merged without conflict.

Left out: everything below is main-only and isn't on release/0.9.

• ci(release): a job after publish downloads the release and checks its digests, cosign bundles, attestations and relaunch (#2721) #2946 / [CI] Verify the published release: download assets, check cosign/attestations/Authenticode/digests, relaunch #2721, the verify-published-release job and the shared tools/verify-windows-signatures.ps1:
  • ci(release): sign both Windows .zips through Azure Artifact Signing, replacing SignPath (#2302) #2944's hunks that edit that job are dropped, and so are its edits to that script (a modify/delete conflict, resolved as deleted).
  • validate-windows-package keeps release/0.9's inline signature check. It is now equivalent to the script's body: it prints each exe's status, signer, thumbprint, issuer and timestamper, then runs cmake -DTASKSMACK_VERIFY_DIR=$pkg -DTASKSMACK_EXPECTED_SIGNER=$env:WINDOWS_EXPECTED_SIGNER -P repo/cmake/VerifyWindowsSignatures.cmake.
  • The check has no SignPath test-signing trust step any more, and it runs on both legs whenever SIGNING_ENABLED.
• ci(release): the smoke launches quit cleanly and check config.toml was saved, and the Windows zip leaves no trace (#2720) #2933 / [CI] Clean-exit hook for smoke checks (assert config saved on exit) and a zip leave-no-trace check #2720, the TASKSMACK_SCREENSHOT clean-quit smoke checks and tools/release-smoke-check.*: not brought over. release/0.9 keeps its own smoke checks.
• ci(release): the validate jobs upgrade over v0.8.0's .deb and start from a 0.8 config (#2726) #2939 / [CI] Upgrade-from-0.8 in the release validate jobs: apt-upgrade over v0.8.0's .deb, and seed the 0.8 config into the smoke launches #2726 (validate-linux-upgrade) and ci(release): the installed helper's polkit action registers, and the helper answers TaskSmack's handshake through pkexec, before a release (#2723) #2891 (validate-linux-helper): not brought over. create-release's needs is release/0.9's list plus validate, which ci(release): sign both Windows .zips through Azure Artifact Signing, replacing SignPath (#2302) #2944 added so that the if: can read needs.validate.outputs.signing. It doesn't include validate-linux-upgrade or validate-linux-helper.

One extra edit the cherry-pick needed. On release/0.9, validate-windows-package's sparse checkout of cmake/VerifyWindowsSignatures.cmake was gated on matrix.signed && env.SIGNING_ENABLED == 'true'. On main that step had already been reworked by #2946/#2933, so #2944 never touched it here. Once matrix.signed is removed, that condition is always false: the checkout would be skipped and the signature check would find no script. It is now if: env.SIGNING_ENABLED == 'true'.

Part of #2302

PR Size

🔴 Large (~431 added / ~294 removed lines over 10 files): the same change as #2944, minus the main-only parts. Most of it is the rewritten sign-windows job and the rewritten signing docs.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Build/CI improvement

Checklist

• I have read the CONTRIBUTING guidelines
• My code follows the project's coding standards
• I have run clang-tidy and addressed any warnings (no C++ changed)
• I have run clang-format on my changes (no C++ changed)
• I have run pre-commit run --all-files or installed pre-commit hooks (pre-commit run --files <touched>, actionlint included: all passed)
• I have added tests that prove my fix/feature works (proved by the signed dry run below; the existing WindowsSignatureGateScript test still covers the unsigned refusal)
• All new and existing tests pass
• I have updated documentation as needed

Testing

pre-commit run --files <touched files>     # all hooks passed, actionlint included
gh workflow run release.yml --ref candidate/azure-signing-2302-0.9 -f dry_run=true

Dry run: 40250896796, run from this branch on 45ff48d with dry_run=true. Every job passed: Validate, both Linux and both Windows builds, Sign Windows Packages (Azure Artifact Signing), both Linux and both Windows validations, all four reproducibility checks, and Create GitHub Release. Nothing was cancelled.

sign-windows: azure/login reported "Azure CLI login succeeds by using OIDC", and the signing call reported "Signing completed with status 'Succeeded'".

File	Status	Signer	Issuer	Timestamp
x64 TaskSmack.exe	Valid	CN=Matt Gradwohl, O=Matt Gradwohl, L=REDMOND, S=wa, C=US	Microsoft ID Verified CS EOC CA 04	Microsoft Public RSA Time Stamping Authority
x64 TaskSmackHelper.exe	Valid	same	same	same
arm64 TaskSmack.exe	Valid	same	same	same
arm64 TaskSmackHelper.exe	Valid	same	same	same

Each .zip (TaskSmack-0.9.0-win64.zip, TaskSmack-0.9.0-windows-arm64.zip) reported "65 entries, only the signed executables changed."

validate-windows-package, both x64 and arm64: "VerifyWindowsSignatures: TaskSmack.exe and TaskSmackHelper.exe are signed and timestamped by Matt Gradwohl". Both executables were Valid, CN=Matt Gradwohl.

Additional Notes

• After this merges, the maintainer can delete SignPath's repository variable SIGNPATH_ORGANIZATION_ID and secret SIGNPATH_API_TOKEN (see ci(release): sign both Windows .zips through Azure Artifact Signing, replacing SignPath (#2302) #2944). Nothing on main or release/0.9 reads them any more.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/azure/artifact-signing-action	c7ab2a863ab5f9a846ddb8265964877ef296ee82	Unknown	Unknown
actions/azure/login	a641126d1b8aa4d1fa005f4f92df94a3a4c4c906	Unknown	Unknown

Scanned Files

• .github/workflows/release.yml