Managed Windows signing for FOSS

Zero-cost, zero-friction Windows code signing for open-source projects

Problem

Open-source maintainers want to sign Windows installers but commercial certificates are expensive, and free signing services often restrict custom GitHub runners, breaking existing build pipelines. The result is unsigned installers flagged by SmartScreen.

Solution

A signing-as-a-service for open-source projects: submit artifacts via a standard GitHub Action or CLI, have them signed server-side with a compliant certificate, and get signed files back. Works with any runner and provides clear audit logs.

Users

Indie open-source developers with no budget, small teams maintaining Windows desktop tools

MVP

GitHub Action and CLI submission with no runner restrictions; queued signing jobs with callbacks; artifact hashes and signing audit records; a free-tier application flow for OSS; clear failure diagnostics

Revenue

Free quota for open-source, usage-based or monthly subscription for commercial projects; one-time license for a self-hosted signing gateway

Why now

SmartScreen keeps tightening on unsigned installers while free signing options restrict build environments, pushing developers toward flexible alternatives