The author introduces aas-sign, a native multi-platform tool they built to streamline Windows code-signing via Azure Artifact Signing (Trusted Signing). Existing alternatives — Azure CLI combined with Jsign or SignTool.exe — impose artificial runtime constraints that break build pipeline composability. aas-sign offers two modes: Laptop mode for interactive signing with a simple CLI, and Action mode for GitHub Actions CI/CD pipelines that works on non-Windows runners. The setup requires a $10/month Azure subscription, identity verification (driver's license) limited to North America, and navigating a notoriously confusing Azure portal — the author recommends using an AI assistant to get through it. The tool computes Authenticode hashes concurrently, sends them to Azure, retrieves signatures and countersignatures, and embeds them directly in PE binaries. It is already used to sign all w64devkit and dcmake releases.
Questions this post answers
What are the alternatives to SignTool.exe for code-signing Windows binaries in a Linux or Docker CI/CD pipeline?
The main alternatives are Azure CLI (Python) combined with either Jsign (Java) or SignTool.exe (Windows-only). Both impose runtime constraints that hurt build pipeline composability — Jsign requires at least a JRE, and SignTool.exe cannot run inside a Docker container at all. aas-sign is a native, multi-platform, single-file application that works inside Docker and on non-Windows GitHub Actions runners. Developers shipping signed Windows binaries from Linux CI keep running into this wall — others navigating the same tradeoffs share notes on daily.dev.
How much does Azure Trusted Signing cost and what are the requirements to set it up?
Azure Trusted Signing costs $10/month for the Azure subscription. The one-time setup requires sharing identity documents (such as a driver's license) with Microsoft and is only open to residents of North America. The Azure portal setup is described as extremely confusing, and using an AI assistant to navigate it is strongly recommended. Those evaluating code-signing options for Windows distribution weigh costs and friction like this on daily.dev.
How do I use aas-sign to code-sign Windows EXEs in a GitHub Actions workflow without a Windows runner?
Add the skeeto/aas-sign@v1.0.0 action to your workflow, providing the Trusted Signing endpoint, account, certificate profile, Azure client ID, and tenant ID as secrets. You also need to create a Federated Identity Credential (FIC) for each repository in the Azure portal. aas-sign then combines these with per-job tokens GitHub injects to authenticate and sign, and it works on any runner OS. Teams automating Windows release pipelines without Windows runners track tooling like aas-sign on daily.dev.