# My brave new code-signing world

DevFeed: [My brave new code-signing world](<https://devfeed.tech/articles/my-brave-new-code-signing-world-20513.md>)

Original publisher: [Read original article](<https://nullprogram.com/blog/2026/04/25/>)

Published: 2026-04-25T18:12:29Z

Content type: opinion

Language: en

Sources: [Chris Wellons](<https://devfeed.tech/sources/chris-wellons.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [Security](<https://devfeed.tech/topics/security.md>), [Code](<https://devfeed.tech/topics/code.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [alternatives](<https://devfeed.tech/tags/alternatives.md>), [azure](<https://devfeed.tech/tags/azure.md>), [claude](<https://devfeed.tech/tags/claude.md>), [cli](<https://devfeed.tech/tags/cli.md>), [cost](<https://devfeed.tech/tags/cost.md>), [cpp](<https://devfeed.tech/tags/cpp.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [github](<https://devfeed.tech/tags/github.md>), [security](<https://devfeed.tech/tags/security.md>), [signing](<https://devfeed.tech/tags/signing.md>)

## AI overview

The article describes the author's move to code-sign Windows releases using Azure Artifact Signing and custom infrastructure called aas-sign. It discusses the cost, regional identity-verification requirement, difficult Azure portal experience, AI-assisted setup, and alternatives involving Azure CLI, Jsign, and SignTool.exe.

## Source excerpt

The new w64devkit release two weeks ago is the first to be code-signed with my identity, verified by Microsoft's certificate chain. Currently only the release packaging is signed -- the self-extracting archive and its payload -- but I will soon code-sign individual EXEs and DLLs within the distribution. In fact, all Windows builds of my project releases have been code-signed the past two weeks, including dcmake, and so should everything going forward. My signing identity builds reputation with each download, so users will have an easier time with SmartScreen, and security software generally. Azure Artifact Signing creates the actual signature, but the rest is done with new infrastructure I built myself, aas-sign. As is often the case, the existing options were deficient for my needs, so I had to build it myself. This code-signing is not free, and simply having aas-sign on hand, or using the GitHub Actions action, is insufficient. You must be serious enough to spend US$10/month for the Azure subscription. After that you are subjected to the labyrinth that is the Azure portal, the most confusing UI I've ever used. Luckily we live in an age of wonders, and I could describe to Claude in Chrome what I wanted and it would happen (Sonnet works better than Opus for this). It took as much time to figure out Azure as I spent creating a fully-functional, native debugger front-end. Clear your schedule if you're going to try it yourself. If it weren't for AI assistance I would have given up. The one-time setup process is only open to North America, and involves sharing identify documents (i.e. driver's license) with Microsoft. Unlike the rest of Azure, that part was streamlined and fairly painless. Between the cost and this requirement, this is a niche space. However, if this is your niche, aas-sign is currently the best software available. It's the tool Microsoft should have written, but didn't due to ongoing institutional failures. The alternatives are a pair of tools: Azure CLI