| 1 | <?xml version="1.0" encoding="utf-8"?> |
| 2 | <!-- Canary-only configuration. SignPath test certificates intentionally do not |
| 3 | chain to a Windows trusted root, so authenticode-verify cannot be used for |
| 4 | the already test-signed payload. The workflow verifies that every payload |
| 5 | executable is signed and hash-identical to the rebuilt portable package. |
| 6 | Stable and RC releases use windows-installer-v2 instead. --> |
| 7 | <artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1"> |
| 8 | <zip-file> |
| 9 | <pe-file path="*installer*.exe"> |
| 10 | <authenticode-sign /> |
| 11 | </pe-file> |
| 12 | </zip-file> |
| 13 | </artifact-configuration> |
| 14 |