Remove CI signing, add unsigned notice to release notes

Author: rodchristiansen

.github/workflows/ci.yml

@@ -53,63 +53,6 @@ jobs:
             Write-Host "Built: dist/$arch/checkin.exe"
           }
 
-      - name: Import signing certificate
-        id: cert
-        if: env.CODE_SIGNING_CERT_BASE64 != ''
-        shell: pwsh
-        env:
-          CODE_SIGNING_CERT_BASE64: ${{ secrets.CODE_SIGNING_CERT_BASE64 }}
-          CODE_SIGNING_CERT_PASSWORD: ${{ secrets.CODE_SIGNING_CERT_PASSWORD }}
-        run: |
-          $pfxBytes = [Convert]::FromBase64String($env:CODE_SIGNING_CERT_BASE64)
-          $pfxPath = Join-Path $env:RUNNER_TEMP "codesign.pfx"
-          [IO.File]::WriteAllBytes($pfxPath, $pfxBytes)
-          $securePassword = ConvertTo-SecureString $env:CODE_SIGNING_CERT_PASSWORD -AsPlainText -Force
-          $cert = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $securePassword
-          echo "thumbprint=$($cert.Thumbprint)" >> $env:GITHUB_OUTPUT
-          Remove-Item $pfxPath -Force
-          Write-Host "Certificate imported: $($cert.Subject)"
-
-      - name: Locate signtool
-        id: signtool
-        if: steps.cert.outputs.thumbprint != ''
-        shell: pwsh
-        run: |
-          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" -ErrorAction SilentlyContinue |
-            Sort-Object FullName -Descending | Select-Object -First 1
-          if ($signtool) {
-            echo "path=$($signtool.FullName)" >> $env:GITHUB_OUTPUT
-            Write-Host "Found signtool: $($signtool.FullName)"
-          } else {
-            Write-Host "::warning::signtool.exe not found on runner"
-          }
-
-      - name: Sign binaries
-        if: steps.cert.outputs.thumbprint != '' && steps.signtool.outputs.path != ''
-        shell: pwsh
-        run: |
-          $signtool = "${{ steps.signtool.outputs.path }}"
-          $thumbprint = "${{ steps.cert.outputs.thumbprint }}"
-          $tsas = @('http://timestamp.digicert.com', 'http://timestamp.sectigo.com')
-
-          foreach ($arch in @("x64", "arm64")) {
-            $exe = "dist/$arch/checkin.exe"
-            $signed = $false
-            foreach ($tsa in $tsas) {
-              & $signtool sign /fd SHA256 /tr $tsa /td SHA256 /sha1 $thumbprint $exe 2>&1
-              if ($LASTEXITCODE -eq 0) {
-                Write-Host "Signed: $exe"
-                $signed = $true
-                break
-              }
-              Write-Host "::warning::Timestamp server $tsa failed, trying next..."
-            }
-            if (-not $signed) {
-              Write-Host "::error::Failed to sign $exe"
-              exit 1
-            }
-          }
-
       - name: Download cimipkg
         shell: pwsh
         env:
@@ -169,31 +112,6 @@ jobs:
             }
           }
 
-      - name: Sign MSI packages
-        if: steps.cert.outputs.thumbprint != '' && steps.signtool.outputs.path != ''
-        shell: pwsh
-        run: |
-          $signtool = "${{ steps.signtool.outputs.path }}"
-          $thumbprint = "${{ steps.cert.outputs.thumbprint }}"
-          $tsas = @('http://timestamp.digicert.com', 'http://timestamp.sectigo.com')
-
-          foreach ($msi in Get-ChildItem release/*.msi) {
-            $signed = $false
-            foreach ($tsa in $tsas) {
-              & $signtool sign /fd SHA256 /tr $tsa /td SHA256 /sha1 $thumbprint $msi.FullName 2>&1
-              if ($LASTEXITCODE -eq 0) {
-                Write-Host "Signed: $($msi.Name)"
-                $signed = $true
-                break
-              }
-              Write-Host "::warning::Timestamp server $tsa failed, trying next..."
-            }
-            if (-not $signed) {
-              Write-Host "::error::Failed to sign $($msi.Name)"
-              exit 1
-            }
-          }
-
       - name: Build NuGet packages
         shell: pwsh
         run: |
@@ -253,3 +171,15 @@ jobs:
           name: Crypt ${{ needs.build.outputs.version }}
           generate_release_notes: true
           files: release/*
+          body: |
+            ## Crypt ${{ needs.build.outputs.version }}
+
+            Binaries and MSI packages are provided **unsigned**. For enterprise deployment, sign them with your organization's code signing certificate before distribution:
+
+            ```powershell
+            # Sign binaries
+            signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /n "Your Certificate Name" checkin.exe
+
+            # Sign MSI packages
+            signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /n "Your Certificate Name" Crypt-x64-${{ needs.build.outputs.version }}.msi
+            ```