From 16ac797008e649f17db7da69124b78729763b76a Mon Sep 17 00:00:00 2001 From: Vladimir Dubrovin <3proxy@3proxy.ru> Date: Wed, 16 Sep 2026 14:09:49 +0300 Subject: [PATCH] Remove self-signed Authenticode signing from Windows builds Signing the release binaries with a self-signed certificate gives no trust benefit: Windows does not recognize the issuer, so SmartScreen warns anyway, and the signature is a frequent trigger for antivirus false positives. Drop the Decode Certificate / Extract public certificate / Sign steps from the MSVC and Watcom workflows, stop shipping the extracted 3proxy.crt in the distribution, and remove the certificate URL from the build version string. Co-Authored-By: Claude Opus 5 --- .github/workflows/build-watcom.yml | 13 +------------ .github/workflows/build-win32.yml | 22 +--------------------- .github/workflows/build-win64.yml | 22 +--------------------- .github/workflows/build-winarm64.yml | 22 +--------------------- 4 files changed, 4 insertions(+), 75 deletions(-) diff --git a/.github/workflows/build-watcom.yml b/.github/workflows/build-watcom.yml index a278500..e683d32 100644 --- a/.github/workflows/build-watcom.yml +++ b/.github/workflows/build-watcom.yml @@ -38,19 +38,8 @@ jobs: - name: make Watcom shell: cmd run: | - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c nmake /F Makefile.watcom - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Sign - shell: pwsh - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy.exe" - & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy_crypt.exe" - name: make dist dir shell: cmd run: | diff --git a/.github/workflows/build-win32.yml b/.github/workflows/build-win32.yml index a0a2f45..9372a6b 100644 --- a/.github/workflows/build-win32.yml +++ b/.github/workflows/build-win32.yml @@ -44,27 +44,8 @@ jobs: cd "D:/a/3proxy/3proxy" set "LIB=%LIB%;c:/vcpkg/installed/x86-windows-static/lib" set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x86-windows-static/include" - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c nmake /F Makefile.msvc WOLFSSL=1 - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Extract public certificate - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert")) - - name: Sign - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName } - name: make dist dir shell: cmd run: | @@ -95,7 +76,6 @@ jobs: copy authors dist\3proxy\ copy README.md dist\3proxy\ copy rus.3ps dist\3proxy\ - copy 3proxy.crt dist\3proxy\ - name: Get artifact uses: actions/upload-artifact@v7 with: diff --git a/.github/workflows/build-win64.yml b/.github/workflows/build-win64.yml index 02bbfa0..c4900f5 100644 --- a/.github/workflows/build-win64.yml +++ b/.github/workflows/build-win64.yml @@ -44,28 +44,9 @@ jobs: cd "D:/a/3proxy/3proxy" set "LIB=%LIB%;c:/vcpkg/installed/x64-windows-static/lib" set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x64-windows-static/include" - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c echo %NOW% / %RELEASE% / %BUILDDATE% / %VERSION% nmake /F Makefile.msvc WOLFSSL=1 - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Extract public certificate - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert")) - - name: Sign - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName } - name: make dist dir shell: cmd run: | @@ -96,7 +77,6 @@ jobs: copy authors dist\3proxy\ copy README.md dist\3proxy\ copy rus.3ps dist\3proxy\ - copy 3proxy.crt dist\3proxy\ - name: Get artifact uses: actions/upload-artifact@v7 with: diff --git a/.github/workflows/build-winarm64.yml b/.github/workflows/build-winarm64.yml index d627e8d..de910fb 100644 --- a/.github/workflows/build-winarm64.yml +++ b/.github/workflows/build-winarm64.yml @@ -44,27 +44,8 @@ jobs: cd "D:/a/3proxy/3proxy" set "LIB=%LIB%;c:/vcpkg/installed/arm64-windows-static/lib" set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/arm64-windows-static/include" - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c nmake /F Makefile.msvc WOLFSSL=1 - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Extract public certificate - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert")) - - name: Sign - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName } - name: make dist dir shell: cmd run: | @@ -95,7 +76,6 @@ jobs: copy authors dist\3proxy\ copy README.md dist\3proxy\ copy rus.3ps dist\3proxy\ - copy 3proxy.crt dist\3proxy\ - name: Get artifact uses: actions/upload-artifact@v7 with: