Building and Signing Desktop Applications for Windows
Code signing is a mandatory step before distributing Windows applications. Without a signature, SmartScreen blocks installation with a "Unknown Publisher" warning. With a valid signature and good reputation, installation proceeds without warnings.
Build tools
Electron + electron-builder — the most common stack for cross-platform applications:
# electron-builder.yml
appId: com.company.appname
productName: AppName
win:
target:
- target: nsis # standard installer
- target: zip # portable version
icon: build/icon.ico
sign: true
nsis:
oneClick: false
perMachine: true
allowToChangeInstallationDirectory: true
Wix Toolset — for MSI packages (enterprise distribution via SCCM/Intune):
<!-- product.wxs -->
<Product Id="*" Name="AppName" Version="1.0.0" Manufacturer="Company">
<Package Compressed="yes" />
<Directory Id="TARGETDIR" Name="SourceDir">
<Directory Id="ProgramFilesFolder">
<Directory Id="INSTALLFOLDER" Name="AppName" />
</Directory>
</Directory>
<Component Id="MainExecutable" Directory="INSTALLFOLDER">
<File Source="AppName.exe" KeyPath="yes" />
</Component>
</Product>
Code Signing
Code signing certificate: EV (Extended Validation) — immediately provides good SmartScreen reputation; OV (Organization Validation) — requires building reputation.
# Signing via signtool.exe
signtool sign `
/fd SHA256 `
/tr http://timestamp.digicert.com `
/td SHA256 `
/f certificate.pfx `
/p $env:CERT_PASSWORD `
"dist\AppName-Setup.exe"
# Verify signature
signtool verify /pa "dist\AppName-Setup.exe"
Auto-signing in CI/CD (GitHub Actions)
- name: Sign Windows executable
env:
CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
run: |
$cert = [Convert]::FromBase64String($env:CERTIFICATE_BASE64)
[IO.File]::WriteAllBytes("certificate.pfx", $cert)
& "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" `
sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 `
/f certificate.pfx /p $env:CERTIFICATE_PASSWORD `
"dist\AppName-Setup.exe"
Timeline
Setup of Windows build and signing: 2–3 business days. Obtaining EV certificate — 3–7 days from CA (DigiCert, Sectigo).