CI: sign Windows with ssign (drop the SimplySign container)

.github/workflows/ci.yml

@@ -233,9 +233,51 @@ jobs:
           name: pinready-${{ matrix.label }}
           path: pinready-${{ matrix.label }}.*
 
-  release:
+  # Authenticode-sign the Windows binary with ssign (the Linux runner signs the
+  # .exe — no Windows, no vendor stack). Gated by the `signing` environment
+  # (owner approval); the release below waits for it, so a tag becomes
+  # build → approve → signed release.
+  sign-windows:
     needs: build
     if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: signing
+    steps:
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install ssign
+        run: cargo install ssign
+
+      - name: Download the Windows artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: pinready-windows-x86_64
+          path: dl
+
+      - name: Sign pinready.exe with ssign (via Certum)
+        env:
+          CERTUM_EMAIL: ${{ secrets.CERTUM_EMAIL }}
+          CERTUM_OTP: ${{ secrets.CERTUM_OTP }}
+        run: |
+          unzip -o dl/pinready-windows-x86_64.zip -d dl
+          ssign --verbose \
+            -n "PinReady" -u "https://github.com/${{ github.repository }}" \
+            dl/pinready.exe
+          sudo apt-get update -qq && sudo apt-get install -y osslsigncode
+          osslsigncode verify dl/pinready.exe 2>&1 | tee verify.txt || true
+          grep -q "Calculated message digest" verify.txt
+          (cd dl && rm -f pinready-windows-x86_64.zip && zip -j pinready-windows-x86_64.zip pinready.exe)
+
+      - name: Re-upload the signed Windows artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: pinready-windows-x86_64
+          path: dl/pinready-windows-x86_64.zip
+          overwrite: true
+
+  release:
+    needs: [build, sign-windows]
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-24.04
     permissions:
       contents: write

target-bookworm/.rustc_info.json

@@ -0,0 +1 @@
+{"rustc_fingerprint":16876993080210027489,"outputs":{"7971740275564407648":{"success":true,"status":"","code":0,"stdout":"___\nlib___.rlib\nlib___.so\nlib___.so\nlib___.a\nlib___.so\n/usr/local/rustup/toolchains/1.96.1-x86_64-unknown-linux-gnu\noff\npacked\nunpacked\n___\ndebug_assertions\npanic=\"unwind\"\nproc_macro\ntarget_abi=\"\"\ntarget_arch=\"x86_64\"\ntarget_endian=\"little\"\ntarget_env=\"gnu\"\ntarget_family=\"unix\"\ntarget_feature=\"fxsr\"\ntarget_feature=\"sse\"\ntarget_feature=\"sse2\"\ntarget_has_atomic=\"16\"\ntarget_has_atomic=\"32\"\ntarget_has_atomic=\"64\"\ntarget_has_atomic=\"8\"\ntarget_has_atomic=\"ptr\"\ntarget_os=\"linux\"\ntarget_pointer_width=\"64\"\ntarget_vendor=\"unknown\"\nunix\n","stderr":""},"14077377089280841642":{"success":true,"status":"","code":0,"stdout":"rustc 1.96.1 (31fca3adb 2026-06-26)\nbinary: rustc\ncommit-hash: 31fca3adb283cc9dfd56b49cdee9a96eb9c96ffd\ncommit-date: 2026-06-26\nhost: x86_64-unknown-linux-gnu\nrelease: 1.96.1\nLLVM version: 22.1.2\n","stderr":""}},"successes":{}}

target-bookworm/CACHEDIR.TAG

@@ -0,0 +1,3 @@
+Signature: 8a477f597d28d172789f06886806bc55
+# This file is a cache directory tag created by cargo.
+# For information about cache directory tags see https://bford.info/cachedir/