#1 [Roadmap] Authenticode code signing — eliminate SmartScreen warning

[Anonymous]

Originally created by: phantasmat2018

Status: Planned, certificate not yet purchased.

The Windows installer (installer/CapyBro-Setup-2.0.0.exe) is currently unsigned. Windows SmartScreen shows "Unknown publisher" on first launch, requiring users to click "More info → Run anyway" — a friction point for new installs.

Plan

1. Purchase an Authenticode certificate:
2. OV (Organization Validated) — ~$200/year, from Sectigo / DigiCert / SSL.com
3. SmartScreen reputation builds over 2–4 weeks of signed downloads
4. Import certificate into Cert:\CurrentUser\My
5. Set environment variable: CAPYBRO_SIGN_THUMBPRINT=<SHA1 thumbprint>
6. Each build runs installer/sign-installer.ps1 automatically

The signing toolchain is already in place — only the certificate purchase + reputation period blocks this.

Acceptance

• [ ] Certificate purchased and imported
• [ ] First signed installer released
• [ ] SmartScreen reputation accumulated (2–4 weeks of signed downloads)
• [ ] README + docs updated to remove "Unknown publisher" warnings