Distribute unsigned Windows releases

The self-signed Authenticode certificate gives Windows no trust and makes
antivirus engines flag the release binaries. Stop signing in the Win32,
Win64, Win-arm64 and Watcom release workflows, drop 3proxy.crt from the
zips and the certificate URL from the version string, and point
SECURITY.md at the checksums, OpenPGP signature and attestation instead.

Fixes #1269

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/build-watcom.yml

@@ -38,19 +38,8 @@ jobs:
     - name: make Watcom
       shell: cmd
       run: |
-       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c
+       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c
        nmake /F Makefile.watcom
-    - name: Decode Certificate
-      shell: pwsh
-      run: |
-       $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte)
-    - name: Sign
-      shell: pwsh
-      run: |
-       $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName
-       & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy.exe"
-       & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}" /tr http://timestamp.digicert.com /td sha256 /fd sha256 "bin\3proxy_crypt.exe"
     - name: make dist dir
       shell: cmd
       run: |

.github/workflows/build-win32.yml

@@ -44,27 +44,8 @@ jobs:
        cd "D:/a/3proxy/3proxy"
        set "LIB=%LIB%;c:/vcpkg/installed/x86-windows-static/lib"
        set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x86-windows-static/include"
-       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c
+       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c
        nmake /F Makefile.msvc WOLFSSL=1
-    - name: Decode Certificate
-      shell: pwsh
-      run: |
-       $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte)
-    - name: Extract public certificate
-      shell: pwsh
-      env:
-       CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-      run: |
-       $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert"))
-    - name: Sign
-      shell: pwsh
-      env:
-       CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-      run: |
-       $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName
-       Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName }
     - name: make dist dir
       shell: cmd
       run: |
@@ -95,7 +76,6 @@ jobs:
        copy authors dist\3proxy\
        copy README.md dist\3proxy\
        copy rus.3ps dist\3proxy\
-       copy 3proxy.crt dist\3proxy\
     - name: Get artifact
       uses: actions/upload-artifact@v7
       with:

.github/workflows/build-win64.yml

@@ -44,28 +44,9 @@ jobs:
        cd "D:/a/3proxy/3proxy"
        set "LIB=%LIB%;c:/vcpkg/installed/x64-windows-static/lib"
        set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x64-windows-static/include"
-       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c
+       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c
        echo %NOW% / %RELEASE% / %BUILDDATE% / %VERSION%
        nmake /F Makefile.msvc WOLFSSL=1
-    - name: Decode Certificate
-      shell: pwsh
-      run: |
-       $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte)
-    - name: Extract public certificate
-      shell: pwsh
-      env:
-       CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-      run: |
-       $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert"))
-    - name: Sign
-      shell: pwsh
-      env:
-       CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-      run: |
-       $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName
-       Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName }
     - name: make dist dir
       shell: cmd
       run: |
@@ -96,7 +77,6 @@ jobs:
        copy authors dist\3proxy\
        copy README.md dist\3proxy\
        copy rus.3ps dist\3proxy\
-       copy 3proxy.crt dist\3proxy\
     - name: Get artifact
       uses: actions/upload-artifact@v7
       with:

.github/workflows/build-winarm64.yml

@@ -44,27 +44,8 @@ jobs:
        cd "D:/a/3proxy/3proxy"
        set "LIB=%LIB%;c:/vcpkg/installed/arm64-windows-static/lib"
        set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/arm64-windows-static/include"
-       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\nCode certificate: https://3proxy.org/3proxy.cer\r\n^";" >>src/3proxy.c
+       echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c
        nmake /F Makefile.msvc WOLFSSL=1
-    - name: Decode Certificate
-      shell: pwsh
-      run: |
-       $pfx_cert_byte = [System.Convert]::FromBase64String("${{ secrets.WINDOWS_CERTIFICATE }}")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\cert.pfx", $pfx_cert_byte)
-    - name: Extract public certificate
-      shell: pwsh
-      env:
-       CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-      run: |
-       $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("${{ github.workspace }}\cert.pfx", "$env:CERT_PASSWORD")
-       [System.IO.File]::WriteAllBytes("${{ github.workspace }}\3proxy.crt", $cert.Export("Cert"))
-    - name: Sign
-      shell: pwsh
-      env:
-       CERT_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-      run: |
-       $signtool = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | Sort-Object { [version]$_.Directory.Parent.Name } -Descending | Select-Object -First 1).FullName
-       Get-ChildItem bin\*.exe, bin\*.dll | ForEach-Object { & $signtool sign /f "${{ github.workspace }}\cert.pfx" /p "$env:CERT_PASSWORD" /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName }
     - name: make dist dir
       shell: cmd
       run: |
@@ -95,7 +76,6 @@ jobs:
        copy authors dist\3proxy\
        copy README.md dist\3proxy\
        copy rus.3ps dist\3proxy\
-       copy 3proxy.crt dist\3proxy\
     - name: Get artifact
       uses: actions/upload-artifact@v7
       with:

SECURITY.md

@@ -80,4 +80,12 @@ gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy
 gh attestation verify oci://docker.io/3proxy/3proxy:latest --owner 3proxy
 ```
 
-Windows binaries are Authenticode signed in addition to the above.
+Windows binaries are not Authenticode signed: a self-signed certificate gives
+no trust to Windows and made antivirus engines flag the binaries as suspicious.
+Verify the release zip with its checksum file, signature and attestation instead:
+
+```
+gpg --verify SHA256SUMS-win-x64.asc SHA256SUMS-win-x64
+sha256sum -c SHA256SUMS-win-x64
+gh attestation verify 3proxy-1.0.0-x64.zip --owner 3proxy
+```