# Change 008: Code Signing & Distribution

## Summary
Sign all executables with Microsoft Trusted Signing for instant SmartScreen trust,
and publish to winget for clean package-manager installs.

## Signing: Microsoft Trusted Signing
- Provider: Microsoft (via Azure)
- Cost: $9.99 USD/month (~$180 AUD/yr)
- Setup: Azure account → Trusted Signing resource → identity validation
- Benefit: Immediate SmartScreen trust (chains to Microsoft CA), no hardware token
- URL: https://azure.microsoft.com/en-au/products/trusted-signing/
- Signing: via Azure CLI / SignTool with Trusted Signing dlib

## Signing Process
After each build on the Windows build host:
```
signtool sign /v /fd sha256 /tr http://timestamp.acs.microsoft.com /td sha256 /dlib "Azure.CodeSigning.Dlib.dll" /dmdf metadata.json NetExperts-Support-Staff.exe
```

## Files to Sign
- NetExperts-Support-Staff.exe (staff installer)
- NetExperts-Support-Client.exe (client/unattended installer)
- netexperts-support.exe (main binary)
- All shipped DLLs

## Build Integration
Add signing as final step in build script, after NSIS packaging:
1. Build client
2. Package with NSIS
3. Sign installers + binaries
4. Verify signatures

## Risk Assessment
- **Breaking risk**: None — post-build step, doesn't change code
- **Regression areas**: Signing validity, timestamp (important for cert expiry)

## Test Cases
1. Signed installer shows "Published by NetExperts" in UAC prompt (not "Unknown publisher")
2. No SmartScreen warning on first run on a clean Windows machine
3. Signature valid after cert renewal (timestamped signatures remain valid)
4. `signtool verify /pa /v NetExperts-Support-Staff.exe` passes
5. Windows Defender does not flag the signed installer
