[Feature]: Request: Sign Windows installer and publish SHA-256 checksums

[MrWrecks]

Before submitting

• I searched existing issues and pull requests for a similar request.

Problem

Hey, thanks for making OpenQuota. I downloaded v0.4.2 from the official GitHub Releases page and used the Windows x64 installer (OpenQuota_0.4.2_x64-setup.exe).
Before running it, I checked the file’s signature and Windows reports that it isn’t digitally signed, so there’s no verified publisher shown. I haven’t installed it because of that.
Is the installer meant to be unsigned, or would you be able to provide a signed Windows installer in a future release? Publishing SHA-256 checksums alongside the releases would also be really helpful.
Thanks again.

Proposed solution

Add Authenticode code signing for the Windows x64 and ARM64 installers, so Windows can verify the publisher and file integrity. It would also help to publish SHA-256 checksums for each release asset.

Provider

No response

Platforms

Windows

Alternatives or additional context

Category: Feature request / enhancement
Version: v0.4.2
Platform: Windows x64
Installer: OpenQuota_0.4.2_x64-setup.exe
Result: Windows reports no digital signature / verified publisher

[deviffyy]

Thanks for the detailed report. The Windows installer is currently unsigned. I'd like to support code signing, but I don't have a suitable signing provider in place yet. GitHub already publishes an immutable SHA-256 digest next to every release asset, so I'll rely on those instead of adding a separate checksum file for now.

[MrWrecks]

Thanks for confirming — I understand this is not a small thing to set up, and I’m not expecting a commitment or timeline.

I did a little reading because I wanted to point you toward the least painful route if you decide to add signing later. Since OpenQuota is built with Tauri, its Windows signing guide covers Azure Artifact Signing (formerly Trusted Signing) with GitHub Actions:

https://tauri.app/distribute/sign/windows/

GitHub artifact attestations might also be a useful interim step. They would let users verify that a release asset was produced by this repository’s build workflow, rather than only compare its SHA-256 hash. I realize that still would not replace a normal Windows publisher signature.

Either way, thank you for the clear answer and for publishing the release digest. :)