> Windows code signing: what your AI agent should know — from The Handover, the-handover.org/services/windows-code-signing
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

# Windows code signing

What we tell an AI agent working on a project that uses Windows code signing: 1 rule, 0 learned the hard way.

Build a full rootnote set for a Windows code signing project: https://the-handover.org/build?areas=working-agreement,desktop&signing=windows

Windows code signing published no file for agents when last checked; this page is the only agent-facing guidance for it we know of.

### Windows signing: sign every executable, timestamp it, and expect early warnings

> General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-18

- **Sign the installer and every executable it installs**, not just the
  installer.
- **Timestamp every signature.** Without it the signature stops validating when
  the certificate expires, and every existing install starts warning.
- **Do not conclude signing failed because SmartScreen still warns.** Reputation
  builds over time for a new certificate or file.
- **Keep signing credentials out of the repository and out of any build that
  runs on an untrusted pull request.**