VehicleHelper release security

Windows Authenticode signing runbook

Sign the immutable release, timestamp it, verify the trust chain, record the post-signing hash, and only then publish the candidate.

consent_0133SHA-256RFC 3161RSA public trust
Current state: procedure and tooling are ready; a validated public signing identity is still required. This page does not claim the current VehicleHelper download is signed.

Choose the identity

Microsoft Artifact Signing

Best managed/CI path when the legal publisher is eligible for Public Trust in a supported region.

OV RSA certificate

Use a public CA and its hardware token/HSM or remote signing service when Artifact Signing is unavailable in the publisher’s region.

Do not use self-signed

It does not establish public SmartScreen trust. EV no longer gets an automatic first-download bypass.

What signing changes

  • Windows can display the validated publisher.
  • Publisher reputation can carry across consistently signed versions.
  • Smart App Control can evaluate a trusted RSA signature.
  • A new publisher or new file hash may still receive an initial SmartScreen warning while reputation builds.

Release order — do not reorder

  1. Build a uniquely versioned, immutable `win-x64` release.
  2. Sign every shipped PE file after its final byte change. Sign `VehicleHelper.exe` and any separately shipped/extracted helper EXEs or DLLs.
  3. Add an RFC 3161 SHA-256 timestamp.
  4. Verify with SignTool and PowerShell.
  5. Record SHA-256 after signing.
  6. Package/upload without modifying signed files, then use the existing `artheru` approval gate.
  7. Test the downloaded bytes and every helper-launching code path on clean Windows 11.
Download signing scriptPlain runbook

CA certificate in Windows store

.\Sign-WindowsRelease.ps1 `
  -BinaryPath .\VehicleHelper.exe `
  -CertificateThumbprint 'YOUR_THUMBPRINT'

The private key stays in the certificate provider. The script never accepts a PFX password.

Microsoft Artifact Signing

.\Sign-WindowsRelease.ps1 `
  -BinaryPath .\VehicleHelper.exe `
  -MetadataPath .\metadata.json `
  -DlibPath .\Azure.CodeSigning.Dlib.dll

Use matching x64 SignTool/dlib versions and the region-specific Artifact Signing endpoint.

Required verification

signtool.exe verify /pa /all /v .\VehicleHelper.exe
Get-AuthenticodeSignature .\VehicleHelper.exe |
  Format-List Status,StatusMessage,SignerCertificate,TimeStamperCertificate
Get-FileHash -Algorithm SHA256 .\VehicleHelper.exe

Ship only when SignTool exits 0, PowerShell reports Valid, the publisher is the expected legal identity, the timestamp exists, and the uploaded hash matches.

Microsoft sources

SmartScreen reputation for Windows app developers Code signing options for Windows app developers Artifact Signing setup quickstart Artifact Signing integration with SignTool SignTool reference Test signatures with Smart App Control