From e9baea0a309e6d4260758a5b347a02c072eeda45 Mon Sep 17 00:00:00 2001 From: Alperen Yurdakul Date: Mon, 14 Sep 2026 21:14:08 +0300 Subject: [PATCH] Distribute unsigned Windows releases The self-signed Authenticode certificate gives Windows no trust and makes antivirus engines flag the release binaries. Stop signing in the Win32, Win64, Win-arm64 and Watcom release workflows, drop 3proxy.crt from the zips and the certificate URL from the version string, and point SECURITY.md at the checksums, OpenPGP signature and attestation instead. Fixes #1269 Co-Authored-By: Claude Opus 5 --- .github/workflows/build-watcom.yml | 13 +------------ .github/workflows/build-win32.yml | 22 +--------------------- .github/workflows/build-win64.yml | 22 +--------------------- .github/workflows/build-winarm64.yml | 22 +--------------------- SECURITY.md | 10 +++++++++- 5 files changed, 13 insertions(+), 76 deletions(-) diff --git a/.github/workflows/build-watcom.yml b/.github/workflows/build-watcom.yml index a278500..e683d32 100644 --- a/.github/workflows/build-watcom.yml +++ b/.github/workflows/build-watcom.yml @@ -38,19 +38,8 @@ jobs: - name: make Watcom shell: cmd run: | - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c nmake /F Makefile.watcom - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Sign - shell: pwsh - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy.exe" - & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy_crypt.exe" - name: make dist dir shell: cmd run: | diff --git a/.github/workflows/build-win32.yml b/.github/workflows/build-win32.yml index a0a2f45..9372a6b 100644 --- a/.github/workflows/build-win32.yml +++ b/.github/workflows/build-win32.yml @@ -44,27 +44,8 @@ jobs: cd "D:/a/3proxy/3proxy" set "LIB=%LIB%;c:/vcpkg/installed/x86-windows-static/lib" set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x86-windows-static/include" - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c nmake /F Makefile.msvc WOLFSSL=1 - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Extract public certificate - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert")) - - name: Sign - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName } - name: make dist dir shell: cmd run: | @@ -95,7 +76,6 @@ jobs: copy authors dist\3proxy\ copy README.md dist\3proxy\ copy rus.3ps dist\3proxy\ - copy 3proxy.crt dist\3proxy\ - name: Get artifact uses: actions/upload-artifact@v7 with: diff --git a/.github/workflows/build-win64.yml b/.github/workflows/build-win64.yml index 02bbfa0..c4900f5 100644 --- a/.github/workflows/build-win64.yml +++ b/.github/workflows/build-win64.yml @@ -44,28 +44,9 @@ jobs: cd "D:/a/3proxy/3proxy" set "LIB=%LIB%;c:/vcpkg/installed/x64-windows-static/lib" set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x64-windows-static/include" - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c echo %NOW% / %RELEASE% / %BUILDDATE% / %VERSION% nmake /F Makefile.msvc WOLFSSL=1 - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Extract public certificate - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert")) - - name: Sign - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName } - name: make dist dir shell: cmd run: | @@ -96,7 +77,6 @@ jobs: copy authors dist\3proxy\ copy README.md dist\3proxy\ copy rus.3ps dist\3proxy\ - copy 3proxy.crt dist\3proxy\ - name: Get artifact uses: actions/upload-artifact@v7 with: diff --git a/.github/workflows/build-winarm64.yml b/.github/workflows/build-winarm64.yml index d627e8d..de910fb 100644 --- a/.github/workflows/build-winarm64.yml +++ b/.github/workflows/build-winarm64.yml @@ -44,27 +44,8 @@ jobs: cd "D:/a/3proxy/3proxy" set "LIB=%LIB%;c:/vcpkg/installed/arm64-windows-static/lib" set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/arm64-windows-static/include" - echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c + echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c nmake /F Makefile.msvc WOLFSSL=1 - - name: Decode Certificate - shell: pwsh - run: | - $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte) - - name: Extract public certificate - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD") - [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert")) - - name: Sign - shell: pwsh - env: - CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} - run: | - $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName - Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName } - name: make dist dir shell: cmd run: | @@ -95,7 +76,6 @@ jobs: copy authors dist\3proxy\ copy README.md dist\3proxy\ copy rus.3ps dist\3proxy\ - copy 3proxy.crt dist\3proxy\ - name: Get artifact uses: actions/upload-artifact@v7 with: diff --git a/SECURITY.md b/SECURITY.md index dd0d711..82e82a3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -80,4 +80,12 @@ gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy gh attestation verify oci://docker.io/3proxy/3proxy:latest --owner 3proxy ``` -Windows binaries are Authenticode signed in addition to the above. +Windows binaries are not Authenticode signed: a self-signed certificate gives +no trust to Windows and made antivirus engines flag the binaries as suspicious. +Verify the release zip with its checksum file, signature and attestation instead: + +``` +gpg --verify SHA256SUMS-win-x64.asc SHA256SUMS-win-x64 +sha256sum -c SHA256SUMS-win-x64 +gh attestation verify 3proxy-1.0.0-x64.zip --owner 3proxy +```