From cded860ddd3a61eb15204920217d3e1d49650711 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 12:49:34 -0700
Subject: [PATCH 01/22] ci: add release workflow that provides binaries for all
 platforms

Assisted-By: Copilot:claude-opus-4.8
---
 .github/workflows/release.yml | 301 ++++++++++++++++++++++++++++++++++
 1 file changed, 301 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..f1b5343
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,301 @@
+name: Release
+
+# Build portable, release-grade binaries for every supported architecture on a
+# version tag, then attach them (plus a SHA256SUMS.txt for pinning) to the
+# GitHub release.
+#
+#   Linux   -> fully-static musl binaries (zero shared-lib deps), built in
+#              Alpine on native amd64 and arm64 runners.
+#   macOS   -> arm64 + x86_64, third-party libs (OpenSSL/curl/zlib) linked
+#              statically via vcpkg; only system libs remain dynamic.
+#   Windows -> x64 static (MSVC static CRT + static deps) -> single self
+#              contained .exe.
+#
+# The Linux artifacts are what a hermetic Bazel `ctx.download` repo rule wants:
+# a self-contained binary that runs anywhere, verified with a pinned sha256.
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+'
+      - '[0-9]+.[0-9]+.[0-9]+'
+      - '[0-9]+.[0-9]+-*'
+      - '[0-9]+.[0-9]+.[0-9]+-*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Version string to embed in asset names (e.g. 2.15).'
+        required: true
+
+env:
+  BUILD_TYPE: Release
+
+permissions:
+  contents: read
+
+jobs:
+  # --------------------------------------------------------------------------
+  # Linux: fully-static musl binaries. Alpine is the canonical place static
+  # linking of OpenSSL + curl + zlib "just works", because musl has no NSS
+  # dlopen machinery -- so getaddrinfo() for timestamp/CRL servers still works
+  # in a 100% static binary (unlike static glibc).
+  # --------------------------------------------------------------------------
+  linux:
+    name: linux-${{ matrix.arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            os: ubuntu-24.04
+          - arch: arm64
+            os: ubuntu-24.04-arm
+    runs-on: ${{ matrix.os }}
+    container: alpine:3.20
+    steps:
+      - name: Install toolchain + static libraries
+        # First step runs before bash exists in the container, so use sh.
+        shell: sh
+        run: |
+          apk add --no-cache \
+            git bash build-base cmake ninja \
+            python3 py3-cryptography \
+            openssl-dev openssl-libs-static \
+            curl-dev curl-static \
+            zlib-dev zlib-static \
+            nghttp2-static brotli-static zstd-static \
+            libidn2-static c-ares-static libpsl-static libunistring-static
+          # NOTE: the curl-transitive *-static set above may need tuning per
+          # Alpine version; the "verify static" step below is the safety net.
+
+      - uses: actions/checkout@v5
+
+      - name: Resolve version
+        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
+
+      - name: Configure
+        run: |
+          cmake -G Ninja -S "$GITHUB_WORKSPACE" -B build \
+            -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
+            -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
+            -DOPENSSL_USE_STATIC_LIBS=TRUE \
+            -DCURL_USE_STATIC_LIBS=TRUE \
+            -DCMAKE_EXE_LINKER_FLAGS="-static -s"
+
+      - name: Build
+        run: cmake --build build
+
+      - name: Verify the binary is fully static
+        run: |
+          bin="build/osslsigncode"
+          file "$bin"
+          if ! file "$bin" | grep -q 'statically linked'; then
+            echo "::error::binary is not fully static"
+            ldd "$bin" || true
+            exit 1
+          fi
+
+      - name: Test
+        run: ctest --test-dir build --output-on-failure
+
+      - name: Package
+        run: |
+          asset="osslsigncode-${VERSION}-linux-${{ matrix.arch }}"
+          install -Dm755 build/osslsigncode "stage/${asset}/osslsigncode"
+          cp COPYING "stage/${asset}/" 2>/dev/null || true
+          tar -C stage -czf "${asset}.tar.gz" "${asset}"
+          sha256sum "${asset}.tar.gz"
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: dist-linux-${{ matrix.arch }}
+          path: osslsigncode-*-linux-*.tar.gz
+          if-no-files-found: error
+
+  # --------------------------------------------------------------------------
+  # macOS: arm64 + x86_64. Third-party deps come from vcpkg static triplets, so
+  # the binary depends only on always-present system libraries. (A truly static
+  # binary is not possible on macOS -- libSystem must be dynamic.)
+  # --------------------------------------------------------------------------
+  macos:
+    name: macos-${{ matrix.arch }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            os: macos-14
+            triplet: arm64-osx
+            osx_arch: arm64
+          - arch: amd64
+            os: macos-13
+            triplet: x64-osx
+            osx_arch: x86_64
+    runs-on: ${{ matrix.os }}
+    env:
+      VCPKG_ROOT: /usr/local/share/vcpkg
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Resolve version
+        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Install test dependency (cryptography)
+        run: |
+          python -m pip install --upgrade pip
+          ARCHFLAGS="-arch ${{ matrix.osx_arch }}" python -m pip install --upgrade cryptography
+
+      - name: Cache vcpkg archives
+        uses: actions/cache@v5
+        with:
+          path: /Users/runner/.cache/vcpkg/archives
+          key: release-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
+          restore-keys: release-${{ matrix.triplet }}-
+
+      - name: Configure
+        run: |
+          cmake -G "Unix Makefiles" -S "$GITHUB_WORKSPACE" -B build \
+            -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
+            -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
+            -DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
+            -DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" \
+            -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
+            -DOPENSSL_USE_STATIC_LIBS=TRUE
+
+      - name: Build
+        run: cmake --build build --config "$BUILD_TYPE"
+
+      - name: Verify no third-party dylibs are linked
+        run: |
+          bin="build/osslsigncode"
+          otool -L "$bin"
+          if otool -L "$bin" | grep -Ei 'vcpkg|Cellar|libssl|libcrypto|libcurl'; then
+            echo "::error::binary links a non-system dylib"
+            exit 1
+          fi
+          strip -S "$bin" || true
+
+      - name: Test
+        run: ctest --test-dir build --output-on-failure
+
+      - name: Package
+        run: |
+          asset="osslsigncode-${VERSION}-macos-${{ matrix.arch }}"
+          mkdir -p "stage/${asset}"
+          cp build/osslsigncode "stage/${asset}/"
+          cp COPYING "stage/${asset}/" 2>/dev/null || true
+          (cd stage && zip -r "../${asset}.zip" "${asset}")
+          shasum -a 256 "${asset}.zip"
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: dist-macos-${{ matrix.arch }}
+          path: osslsigncode-*-macos-*.zip
+          if-no-files-found: error
+
+  # --------------------------------------------------------------------------
+  # Windows: x64, MSVC static triplet -> static CRT + static deps -> a single
+  # self-contained .exe (no vcredist / no third-party DLLs).
+  # --------------------------------------------------------------------------
+  windows:
+    name: windows-x64
+    runs-on: windows-2022
+    env:
+      VCPKG_ROOT: C:/vcpkg
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Resolve version
+        shell: bash
+        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
+
+      - name: Configure Visual Studio
+        uses: step-security/msvc-dev-cmd@v1
+        with:
+          arch: x64
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Install test dependency (cryptography)
+        run: python -m pip install --upgrade pip cryptography
+
+      - name: Cache vcpkg archives
+        uses: actions/cache@v5
+        with:
+          path: C:/Users/runneradmin/AppData/Local/vcpkg/archives
+          key: release-x64-windows-static-${{ hashFiles('vcpkg.json') }}
+          restore-keys: release-x64-windows-static-
+
+      - name: Configure
+        run: |
+          cmake -G Ninja -S "${{ github.workspace }}" -B build `
+            -DCMAKE_BUILD_TYPE="${{ env.BUILD_TYPE }}" `
+            -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/dist" `
+            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DVCPKG_TARGET_TRIPLET="x64-windows-static" `
+            -DOPENSSL_USE_STATIC_LIBS=TRUE
+
+      - name: Build
+        run: cmake --build build --config ${{ env.BUILD_TYPE }}
+
+      - name: Test
+        working-directory: build
+        run: ctest -C ${{ env.BUILD_TYPE }} --output-on-failure
+
+      - name: Package
+        shell: bash
+        run: |
+          asset="osslsigncode-${VERSION}-windows-x64"
+          mkdir -p "stage/${asset}"
+          cp build/osslsigncode.exe "stage/${asset}/"
+          cp COPYING "stage/${asset}/" 2>/dev/null || true
+          (cd stage && 7z a -tzip "../${asset}.zip" "${asset}")
+          sha256sum "${asset}.zip"
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: dist-windows-x64
+          path: osslsigncode-*-windows-*.zip
+          if-no-files-found: error
+
+  # --------------------------------------------------------------------------
+  # Publish: collect every artifact, generate SHA256SUMS.txt, attach to release.
+  # --------------------------------------------------------------------------
+  release:
+    needs: [linux, macos, windows]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # required to create/modify the release
+    steps:
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v6
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Generate checksums
+        run: |
+          cd dist
+          sha256sum * > SHA256SUMS.txt
+          echo "----- SHA256SUMS.txt -----"
+          cat SHA256SUMS.txt
+
+      - name: Create / update the GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
+          name: ${{ github.event.inputs.tag || github.ref_name }}
+          draft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          generate_release_notes: true
+          fail_on_unmatched_files: true
+          files: |
+            dist/*.tar.gz
+            dist/*.zip
+            dist/SHA256SUMS.txt

From 90dad01f68278fc910485ef2f713f3db93813e37 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 13:16:56 -0700
Subject: [PATCH 02/22] ci: use static zlib while building

---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f1b5343..2ee1f65 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,6 +78,8 @@ jobs:
           cmake -G Ninja -S "$GITHUB_WORKSPACE" -B build \
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
+            -DCMAKE_FIND_LIBRARY_SUFFIXES=".a" \
+            -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE \
             -DCURL_USE_STATIC_LIBS=TRUE \
             -DCMAKE_EXE_LINKER_FLAGS="-static -s"
@@ -164,6 +166,7 @@ jobs:
             -DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
             -DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" \
             -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
+            -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE
 
       - name: Build

From 8d9731cb51edac09ac6e43ba024ffe827204ebf4 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 13:23:44 -0700
Subject: [PATCH 03/22] ci: update to also build windows arm

---
 .github/workflows/release.yml | 36 +++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2ee1f65..65cf827 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -126,11 +126,11 @@ jobs:
       matrix:
         include:
           - arch: arm64
-            os: macos-14
+            os: macos-latest
             triplet: arm64-osx
             osx_arch: arm64
           - arch: amd64
-            os: macos-13
+            os: macos-26-intel
             triplet: x64-osx
             osx_arch: x86_64
     runs-on: ${{ matrix.os }}
@@ -205,8 +205,22 @@ jobs:
   # self-contained .exe (no vcredist / no third-party DLLs).
   # --------------------------------------------------------------------------
   windows:
-    name: windows-x64
-    runs-on: windows-2022
+    name: windows
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            os: windows-11-arm
+            triplet: arm64-windows-static
+            vs_arch: arm64
+            win_arch: arm64
+          - arch: amd64
+            os: windows-latest
+            triplet: x64-windows-static
+            vs_arch: amd64
+            win_arch: x64
+    runs-on: ${{matrix.os}}
     env:
       VCPKG_ROOT: C:/vcpkg
     steps:
@@ -219,7 +233,7 @@ jobs:
       - name: Configure Visual Studio
         uses: step-security/msvc-dev-cmd@v1
         with:
-          arch: x64
+          arch: ${{matrix.vs_arch}}
 
       - uses: actions/setup-python@v6
         with:
@@ -232,8 +246,8 @@ jobs:
         uses: actions/cache@v5
         with:
           path: C:/Users/runneradmin/AppData/Local/vcpkg/archives
-          key: release-x64-windows-static-${{ hashFiles('vcpkg.json') }}
-          restore-keys: release-x64-windows-static-
+          key: release-${{matrix.triplet}}-windows-static-${{ hashFiles('vcpkg.json') }}
+          restore-keys: release-${{matrix.triplet}}-windows-static-
 
       - name: Configure
         run: |
@@ -241,7 +255,9 @@ jobs:
             -DCMAKE_BUILD_TYPE="${{ env.BUILD_TYPE }}" `
             -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/dist" `
             -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
-            -DVCPKG_TARGET_TRIPLET="x64-windows-static" `
+            -DVCPKG_TARGET_ARCHITECTURE="${{matrix.win_arch}}" `
+            -DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" `
+            -DZLIB_USE_STATIC_LIBS=TRUE `
             -DOPENSSL_USE_STATIC_LIBS=TRUE
 
       - name: Build
@@ -254,7 +270,7 @@ jobs:
       - name: Package
         shell: bash
         run: |
-          asset="osslsigncode-${VERSION}-windows-x64"
+          asset="osslsigncode-${VERSION}-windows-${{matrix.arch}}"
           mkdir -p "stage/${asset}"
           cp build/osslsigncode.exe "stage/${asset}/"
           cp COPYING "stage/${asset}/" 2>/dev/null || true
@@ -263,7 +279,7 @@ jobs:
 
       - uses: actions/upload-artifact@v6
         with:
-          name: dist-windows-x64
+          name: dist-windows-${{matrix.arch}}
           path: osslsigncode-*-windows-*.zip
           if-no-files-found: error
 

From 1caa426f3e7e05a6d5e7a4aea4aa807bd868c5ac Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:23:48 -0700
Subject: [PATCH 04/22] ci: build openssl to include the legacy module
 statically

---
 .github/workflows/release.yml | 38 ++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 65cf827..de12694 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,6 +29,8 @@ on:
 
 env:
   BUILD_TYPE: Release
+  OPENSSL_VERSION: "3.5.7"
+  OPENSSL_PREFIX: /opt/openssl-static
 
 permissions:
   contents: read
@@ -48,11 +50,45 @@ jobs:
         include:
           - arch: amd64
             os: ubuntu-24.04
+            openssl_arch: x86_64
           - arch: arm64
             os: ubuntu-24.04-arm
     runs-on: ${{ matrix.os }}
     container: alpine:3.20
     steps:
+      - uses: laverdet/alpine-arm64@v1
+        if: matrix.arch == 'arm64'
+
+      - name: Install OpenSSL build toolchain
+        shell: sh
+        run: apk add --no-cache build-base perl make linux-headers wget tar
+
+      - name: Restore cached OpenSSL
+        id: cache-openssl
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.OPENSSL_PREFIX }}
+          # Deterministic: depends only on inputs that change the artifact.
+          key: openssl-${{ env.OPENSSL_VERSION }}-nomodule-static-${{ matrix.arch }}-alpine3.20
+
+      - name: Build OpenSSL (static, no-module, legacy built-in)
+        if: steps.cache-openssl.outputs.cache-hit != 'true'
+        shell: sh
+        run: |
+          set -eux
+          cd /tmp
+          wget -O openssl.tar.gz \
+            "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz"
+          tar xf openssl.tar.gz
+          cd "openssl-${OPENSSL_VERSION}"
+          # ./config auto-detects amd64 vs arm64, so it works for both matrix rows.
+          # no-module => legacy provider is compiled into libcrypto.a (no dlopen).
+          ./config \
+            no-shared no-module no-tests enable-legacy \
+            --prefix="${OPENSSL_PREFIX}" --openssldir="${OPENSSL_PREFIX}/ssl"
+          make -j"$(nproc)"
+          make install_sw   # install_sw skips man pages -> faster
+
       - name: Install toolchain + static libraries
         # First step runs before bash exists in the container, so use sh.
         shell: sh
@@ -60,7 +96,6 @@ jobs:
           apk add --no-cache \
             git bash build-base cmake ninja \
             python3 py3-cryptography \
-            openssl-dev openssl-libs-static \
             curl-dev curl-static \
             zlib-dev zlib-static \
             nghttp2-static brotli-static zstd-static \
@@ -80,6 +115,7 @@ jobs:
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DCMAKE_FIND_LIBRARY_SUFFIXES=".a" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
+            -DOPENSSL_ROOT_DIR="${OPENSSL_PREFIX}" \
             -DOPENSSL_USE_STATIC_LIBS=TRUE \
             -DCURL_USE_STATIC_LIBS=TRUE \
             -DCMAKE_EXE_LINKER_FLAGS="-static -s"

From 2597bd37a5442f226e397000192ea1806d41066d Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:25:16 -0700
Subject: [PATCH 05/22] ci: use requested cmake version rather than newer
 version

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de12694..07173ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -201,6 +201,7 @@ jobs:
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
             -DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" \
+            -DVCPKG_INSTALL_OPTIONS="--x-abi-tools-use-exact-versions" \
             -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE

From 1ebbab8d8384786d1d2c897e60145cadba6d3c34 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:25:54 -0700
Subject: [PATCH 06/22] ci: python cryptography doesn't provide win-arm64
 build, use x64

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 07173ad..d9c3797 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -275,6 +275,7 @@ jobs:
       - uses: actions/setup-python@v6
         with:
           python-version: '3.13'
+          architecture: x64
 
       - name: Install test dependency (cryptography)
         run: python -m pip install --upgrade pip cryptography

From c8cf55d8a76887da2bce5c13e46045c508ac8083 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:53:22 -0700
Subject: [PATCH 07/22] ci: add dump of test details on failure

---
 .github/workflows/release.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d9c3797..e0d0f2c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -136,6 +136,21 @@ jobs:
       - name: Test
         run: ctest --test-dir build --output-on-failure
 
+      - name: Dump test server logs on failure
+        if: always() # run even though the Test step failed the job
+        shell: bash
+        run: |
+          echo "===== CTest LastTest.log ====="
+          cat build/Testing/Temporary/LastTest.log || true
+
+          echo "===== Any server / TSA logs under build/Testing ====="
+          # The harness writes server output here; names vary by version.
+          find build/Testing -type f \( -name '*.log' -o -name '*server*' -o -name '*.out' \) \
+            -print -exec echo '--- {} ---' \; -exec cat {} \; 2>/dev/null || true
+
+          echo "===== Python / cryptography versions (harness deps) ====="
+          python3 -c 'import sys, cryptography; print(sys.version); print("cryptography", cryptography.__version__)' || truearget_link_options(${target} PRIVATE /CETCOMPAT)
+
       - name: Package
         run: |
           asset="osslsigncode-${VERSION}-linux-${{ matrix.arch }}"

From 6437e22721d6cc6e410d0974e389c99786a57e3d Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:54:30 -0700
Subject: [PATCH 08/22] ci: force mac to download correct cmake version

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e0d0f2c..d40574d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -187,6 +187,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     env:
       VCPKG_ROOT: /usr/local/share/vcpkg
+      VCPKG_FORCE_DOWNLOADED_BINARIES: "1" # ignore Homebrew cmake; use vcpkg's pinned 3.x
     steps:
       - uses: actions/checkout@v5
 

From 1da6a048aa1185435adc19d1102ac04c40aeee90 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:55:06 -0700
Subject: [PATCH 09/22] build: set CETCOMPAT only on x86/x64 arch

---
 cmake/SetCompilerFlags.cmake | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cmake/SetCompilerFlags.cmake b/cmake/SetCompilerFlags.cmake
index 478f824..432507d 100644
--- a/cmake/SetCompilerFlags.cmake
+++ b/cmake/SetCompilerFlags.cmake
@@ -59,7 +59,10 @@ function(add_compile_flags target)
         # Create terminal server aware application (default on)
         target_link_options(${target} PRIVATE /TSAWARE)
         # Mark the binary as compatible with Intel Control-flow Enforcement Technology (CET) Shadow Stack
-        target_link_options(${target} PRIVATE /CETCOMPAT)
+        # /CETCOMPAT is only valid for x86/x64 targets; it errors with LNK1246 on ARM/ARM64.
+        if(MSVC_C_ARCHITECTURE_ID MATCHES "^(X86|x64|AMD64)$")
+            target_link_options(${target} PRIVATE /CETCOMPAT)
+        endif()
         # Enable compiler generation of Control Flow Guard security checks
         target_compile_options(${target} PRIVATE /guard:cf)
         target_link_options(${target} PRIVATE /guard:cf)

From 5a5943d0711aaef1349f8e21afe9c3c0674b017c Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:17:41 -0700
Subject: [PATCH 10/22] ci: update to get all passing ci

ci: add changes/tweaks from ci.yml to release.yml
---
 .github/workflows/release.yml | 184 +++++++++++++++++++++++++---------
 1 file changed, 139 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d40574d..c05bb62 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,6 @@ on:
 env:
   BUILD_TYPE: Release
   OPENSSL_VERSION: "3.5.7"
-  OPENSSL_PREFIX: /opt/openssl-static
 
 permissions:
   contents: read
@@ -50,27 +49,47 @@ jobs:
         include:
           - arch: amd64
             os: ubuntu-24.04
-            openssl_arch: x86_64
+            py_arch: x64
           - arch: arm64
             os: ubuntu-24.04-arm
+            py_arch: arm64
     runs-on: ${{ matrix.os }}
     container: alpine:3.20
+    env:
+      OPENSSL_PREFIX: /opt/openssl-static
+      PYTHONUNBUFFERED: "1"
     steps:
       - uses: laverdet/alpine-arm64@v1
         if: matrix.arch == 'arm64'
 
-      - name: Install OpenSSL build toolchain
+      - name: Install system packages
+        # First step runs before bash exists in the container, so use sh.
         shell: sh
-        run: apk add --no-cache build-base perl make linux-headers wget tar
+        run: |
+          apk add --update --no-cache \
+            git bash build-base cmake ninja \
+            python3 py3-pip openssl \
+            openssl-dev openssl-libs-static \
+            curl-dev curl-static wget tar perl \
+            zlib-dev zlib-static linux-headers \
+            nghttp2-static brotli-static zstd-static \
+            libidn2-static c-ares-static libpsl-static libunistring-static
+          ln -sf python3 /usr/bin/python
 
       - name: Restore cached OpenSSL
         id: cache-openssl
         uses: actions/cache@v4
         with:
           path: ${{ env.OPENSSL_PREFIX }}
-          # Deterministic: depends only on inputs that change the artifact.
           key: openssl-${{ env.OPENSSL_VERSION }}-nomodule-static-${{ matrix.arch }}-alpine3.20
 
+      - name: Validate Python Setup
+        run: |
+          pip install --break-system-packages --upgrade 'cryptography>=43,<46'
+          python -c "import sys; print(sys.executable)"
+          python --version
+          python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
+
       - name: Build OpenSSL (static, no-module, legacy built-in)
         if: steps.cache-openssl.outputs.cache-hit != 'true'
         shell: sh
@@ -89,31 +108,22 @@ jobs:
           make -j"$(nproc)"
           make install_sw   # install_sw skips man pages -> faster
 
-      - name: Install toolchain + static libraries
-        # First step runs before bash exists in the container, so use sh.
-        shell: sh
-        run: |
-          apk add --no-cache \
-            git bash build-base cmake ninja \
-            python3 py3-cryptography \
-            curl-dev curl-static \
-            zlib-dev zlib-static \
-            nghttp2-static brotli-static zstd-static \
-            libidn2-static c-ares-static libpsl-static libunistring-static
-          # NOTE: the curl-transitive *-static set above may need tuning per
-          # Alpine version; the "verify static" step below is the safety net.
-
       - uses: actions/checkout@v5
 
       - name: Resolve version
         run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
 
+      - name: Validate Python Setup
+        run: |
+          python -c "import sys; print(sys.executable)"
+          python --version
+          python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
+
       - name: Configure
         run: |
-          cmake -G Ninja -S "$GITHUB_WORKSPACE" -B build \
+          cmake -G 'Unix Makefiles' -S "$GITHUB_WORKSPACE" -B build \
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
-            -DCMAKE_FIND_LIBRARY_SUFFIXES=".a" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_ROOT_DIR="${OPENSSL_PREFIX}" \
             -DOPENSSL_USE_STATIC_LIBS=TRUE \
@@ -134,22 +144,20 @@ jobs:
           fi
 
       - name: Test
-        run: ctest --test-dir build --output-on-failure
-
-      - name: Dump test server logs on failure
-        if: always() # run even though the Test step failed the job
-        shell: bash
+        working-directory: build
         run: |
-          echo "===== CTest LastTest.log ====="
-          cat build/Testing/Temporary/LastTest.log || true
-
-          echo "===== Any server / TSA logs under build/Testing ====="
-          # The harness writes server output here; names vary by version.
-          find build/Testing -type f \( -name '*.log' -o -name '*server*' -o -name '*.out' \) \
-            -print -exec echo '--- {} ---' \; -exec cat {} \; 2>/dev/null || true
+          ctest --output-on-failure -C "$BUILD_TYPE"
 
-          echo "===== Python / cryptography versions (harness deps) ====="
-          python3 -c 'import sys, cryptography; print(sys.version); print("cryptography", cryptography.__version__)' || truearget_link_options(${target} PRIVATE /CETCOMPAT)
+      - name: Upload the errors
+        uses: actions/upload-artifact@v6
+        if: failure()
+        with:
+          name: errors-${{matrix.os}}
+          path: |
+            ${{github.workspace}}/build/Testing/Temporary/LastTest.log
+            ${{github.workspace}}/build/Testing/conf/makecerts.log
+            ${{github.workspace}}/build/Testing/logs/server.log
+            ${{github.workspace}}/build/Testing/logs/port.log
 
       - name: Package
         run: |
@@ -177,31 +185,75 @@ jobs:
       matrix:
         include:
           - arch: arm64
-            os: macos-latest
+            os: macos-26
             triplet: arm64-osx
             osx_arch: arm64
+            py_arch: arm64
           - arch: amd64
             os: macos-26-intel
             triplet: x64-osx
             osx_arch: x86_64
+            py_arch: x64
     runs-on: ${{ matrix.os }}
     env:
       VCPKG_ROOT: /usr/local/share/vcpkg
-      VCPKG_FORCE_DOWNLOADED_BINARIES: "1" # ignore Homebrew cmake; use vcpkg's pinned 3.x
+      ZLIB_VERSION: 1.3.1
+      ZLIB_PREFIX: /tmp/zlibinstall
     steps:
+      - name: Restore cached ZLib
+        id: cache-zlib
+        uses: actions/cache@v4
+        with:
+          path: "${{env.ZLIB_PREFIX}}"
+          key: zlib-${{ env.ZLIB_VERSION }}-static-${{ matrix.arch }}-macos
+
+      - name: Build ZLib
+        if: steps.cache-zlib.outputs.cache-hit != 'true'
+        shell: sh
+        run: |
+          set -eux
+          cd /tmp
+          wget -O zlib.tar.gz \
+            "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz"
+          tar xf zlib.tar.gz
+          cd "zlib-${ZLIB_VERSION}"
+          # ./config auto-detects amd64 vs arm64, so it works for both matrix rows.
+          # no-module => legacy provider is compiled into libcrypto.a (no dlopen).
+          CFLAGS="-arch ${{ matrix.osx_arch }}" ./configure --static --prefix="${{env.ZLIB_PREFIX}}"
+          make -j"$(sysctl -n hw.ncpu)"
+          make install
+
       - uses: actions/checkout@v5
 
       - name: Resolve version
         run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
 
+      - name: Install Xcode (macOS)
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: latest-stable
+
+      - name: Setup the oldest supported version of cmake (macOS)
+        uses: jwlawson/actions-setup-cmake@v2.2.0
+
       - uses: actions/setup-python@v6
         with:
           python-version: '3.13'
+          update-environment: false
+          architecture: ${{matrix.py_arch}}
+
+      - name: Set up Python virtual environment
+        run: |
+          python -m venv --system-site-packages --copies venv
 
       - name: Install test dependency (cryptography)
         run: |
+          source venv/bin/activate
           python -m pip install --upgrade pip
           ARCHFLAGS="-arch ${{ matrix.osx_arch }}" python -m pip install --upgrade cryptography
+          python -c "import sys; print(sys.executable)"
+          python --version
+          python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
       - name: Cache vcpkg archives
         uses: actions/cache@v5
@@ -212,18 +264,21 @@ jobs:
 
       - name: Configure
         run: |
-          cmake -G "Unix Makefiles" -S "$GITHUB_WORKSPACE" -B build \
+          source venv/bin/activate
+          cmake -G "Unix Makefiles" -S "${{github.workspace}}" -B "${{github.workspace}}/build" \
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
-            -DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
-            -DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" \
-            -DVCPKG_INSTALL_OPTIONS="--x-abi-tools-use-exact-versions" \
             -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
+            -DZLIB_ROOT="${{env.ZLIB_PREFIX}}" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE
 
+        #-DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" \
+        #-DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
+
       - name: Build
-        run: cmake --build build --config "$BUILD_TYPE"
+        run: |
+          cmake --build "${{github.workspace}}/build" --config "$BUILD_TYPE"
 
       - name: Verify no third-party dylibs are linked
         run: |
@@ -236,7 +291,21 @@ jobs:
           strip -S "$bin" || true
 
       - name: Test
-        run: ctest --test-dir build --output-on-failure
+        working-directory: build
+        run: |
+          source ../venv/bin/activate
+          ctest --output-on-failure -C "$BUILD_TYPE"
+
+      - name: Upload the errors
+        uses: actions/upload-artifact@v6
+        if: failure()
+        with:
+          name: errors-${{matrix.os}}
+          path: |
+            ${{github.workspace}}/build/Testing/Temporary/LastTest.log
+            ${{github.workspace}}/build/Testing/conf/makecerts.log
+            ${{github.workspace}}/build/Testing/logs/server.log
+            ${{github.workspace}}/build/Testing/logs/port.log
 
       - name: Package
         run: |
@@ -293,8 +362,19 @@ jobs:
           python-version: '3.13'
           architecture: x64
 
+      - name: Set up Python virtual environment
+        run: |
+          python -m venv --system-site-packages --copies venv
+
       - name: Install test dependency (cryptography)
-        run: python -m pip install --upgrade pip cryptography
+        run: |
+          .\venv\Scripts\Activate.ps1
+          python -m ensurepip
+          python -m pip install --upgrade pip
+          python -m pip install --upgrade pip cryptography
+          python.exe -c "import sys; print(sys.executable)"
+          python.exe --version
+          python.exe -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
       - name: Cache vcpkg archives
         uses: actions/cache@v5
@@ -305,6 +385,7 @@ jobs:
 
       - name: Configure
         run: |
+          .\venv\Scripts\Activate.ps1
           cmake -G Ninja -S "${{ github.workspace }}" -B build `
             -DCMAKE_BUILD_TYPE="${{ env.BUILD_TYPE }}" `
             -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/dist" `
@@ -319,7 +400,20 @@ jobs:
 
       - name: Test
         working-directory: build
-        run: ctest -C ${{ env.BUILD_TYPE }} --output-on-failure
+        run: |
+          ..\venv\Scripts\Activate.ps1
+          ctest -C ${{ env.BUILD_TYPE }} --output-on-failure
+
+      - name: Upload the errors
+        uses: actions/upload-artifact@v6
+        if: failure()
+        with:
+          name: errors-${{matrix.os}}
+          path: |
+            ${{github.workspace}}/build/Testing/Temporary/LastTest.log
+            ${{github.workspace}}/build/Testing/conf/makecerts.log
+            ${{github.workspace}}/build/Testing/logs/server.log
+            ${{github.workspace}}/build/Testing/logs/port.log
 
       - name: Package
         shell: bash

From 59cfad7c207ead29fb5be4d95883a55c4cd57881 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 17:53:15 -0700
Subject: [PATCH 11/22] ci: try without building openssl from source

---
 .github/workflows/release.yml | 48 +++++++++++++++++------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c05bb62..3642406 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -76,12 +76,12 @@ jobs:
             libidn2-static c-ares-static libpsl-static libunistring-static
           ln -sf python3 /usr/bin/python
 
-      - name: Restore cached OpenSSL
-        id: cache-openssl
-        uses: actions/cache@v4
-        with:
-          path: ${{ env.OPENSSL_PREFIX }}
-          key: openssl-${{ env.OPENSSL_VERSION }}-nomodule-static-${{ matrix.arch }}-alpine3.20
+      #- name: Restore cached OpenSSL
+      #  id: cache-openssl
+      #  uses: actions/cache@v4
+      #  with:
+      #    path: ${{ env.OPENSSL_PREFIX }}
+      #    key: openssl-${{ env.OPENSSL_VERSION }}-nomodule-static-${{ matrix.arch }}-alpine3.20
 
       - name: Validate Python Setup
         run: |
@@ -90,23 +90,23 @@ jobs:
           python --version
           python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
-      - name: Build OpenSSL (static, no-module, legacy built-in)
-        if: steps.cache-openssl.outputs.cache-hit != 'true'
-        shell: sh
-        run: |
-          set -eux
-          cd /tmp
-          wget -O openssl.tar.gz \
-            "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz"
-          tar xf openssl.tar.gz
-          cd "openssl-${OPENSSL_VERSION}"
-          # ./config auto-detects amd64 vs arm64, so it works for both matrix rows.
-          # no-module => legacy provider is compiled into libcrypto.a (no dlopen).
-          ./config \
-            no-shared no-module no-tests enable-legacy \
-            --prefix="${OPENSSL_PREFIX}" --openssldir="${OPENSSL_PREFIX}/ssl"
-          make -j"$(nproc)"
-          make install_sw   # install_sw skips man pages -> faster
+      #- name: Build OpenSSL (static, no-module, legacy built-in)
+      #  if: steps.cache-openssl.outputs.cache-hit != 'true'
+      #  shell: sh
+      #  run: |
+      #    set -eux
+      #    cd /tmp
+      #    wget -O openssl.tar.gz \
+      #      "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz"
+      #    tar xf openssl.tar.gz
+      #    cd "openssl-${OPENSSL_VERSION}"
+      #    # ./config auto-detects amd64 vs arm64, so it works for both matrix rows.
+      #    # no-module => legacy provider is compiled into libcrypto.a (no dlopen).
+      #    ./config \
+      #      no-shared no-module no-tests enable-legacy \
+      #      --prefix="${OPENSSL_PREFIX}" --openssldir="${OPENSSL_PREFIX}/ssl"
+      #    make -j"$(nproc)"
+      #    make install_sw   # install_sw skips man pages -> faster
 
       - uses: actions/checkout@v5
 
@@ -125,10 +125,10 @@ jobs:
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
-            -DOPENSSL_ROOT_DIR="${OPENSSL_PREFIX}" \
             -DOPENSSL_USE_STATIC_LIBS=TRUE \
             -DCURL_USE_STATIC_LIBS=TRUE \
             -DCMAKE_EXE_LINKER_FLAGS="-static -s"
+        #-DOPENSSL_ROOT_DIR="${OPENSSL_PREFIX}" \
 
       - name: Build
         run: cmake --build build

From 0855a9aa125ee502987f1e3ece775b84d4cbb16c Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:02:06 -0700
Subject: [PATCH 12/22] ci: cleanup

---
 .github/workflows/release.yml | 39 -----------------------------------
 1 file changed, 39 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3642406..c67af06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,6 @@ on:
 
 env:
   BUILD_TYPE: Release
-  OPENSSL_VERSION: "3.5.7"
 
 permissions:
   contents: read
@@ -55,15 +54,11 @@ jobs:
             py_arch: arm64
     runs-on: ${{ matrix.os }}
     container: alpine:3.20
-    env:
-      OPENSSL_PREFIX: /opt/openssl-static
-      PYTHONUNBUFFERED: "1"
     steps:
       - uses: laverdet/alpine-arm64@v1
         if: matrix.arch == 'arm64'
 
       - name: Install system packages
-        # First step runs before bash exists in the container, so use sh.
         shell: sh
         run: |
           apk add --update --no-cache \
@@ -74,51 +69,18 @@ jobs:
             zlib-dev zlib-static linux-headers \
             nghttp2-static brotli-static zstd-static \
             libidn2-static c-ares-static libpsl-static libunistring-static
-          ln -sf python3 /usr/bin/python
-
-      #- name: Restore cached OpenSSL
-      #  id: cache-openssl
-      #  uses: actions/cache@v4
-      #  with:
-      #    path: ${{ env.OPENSSL_PREFIX }}
-      #    key: openssl-${{ env.OPENSSL_VERSION }}-nomodule-static-${{ matrix.arch }}-alpine3.20
 
       - name: Validate Python Setup
         run: |
-          pip install --break-system-packages --upgrade 'cryptography>=43,<46'
           python -c "import sys; print(sys.executable)"
           python --version
           python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
-      #- name: Build OpenSSL (static, no-module, legacy built-in)
-      #  if: steps.cache-openssl.outputs.cache-hit != 'true'
-      #  shell: sh
-      #  run: |
-      #    set -eux
-      #    cd /tmp
-      #    wget -O openssl.tar.gz \
-      #      "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz"
-      #    tar xf openssl.tar.gz
-      #    cd "openssl-${OPENSSL_VERSION}"
-      #    # ./config auto-detects amd64 vs arm64, so it works for both matrix rows.
-      #    # no-module => legacy provider is compiled into libcrypto.a (no dlopen).
-      #    ./config \
-      #      no-shared no-module no-tests enable-legacy \
-      #      --prefix="${OPENSSL_PREFIX}" --openssldir="${OPENSSL_PREFIX}/ssl"
-      #    make -j"$(nproc)"
-      #    make install_sw   # install_sw skips man pages -> faster
-
       - uses: actions/checkout@v5
 
       - name: Resolve version
         run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
 
-      - name: Validate Python Setup
-        run: |
-          python -c "import sys; print(sys.executable)"
-          python --version
-          python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
-
       - name: Configure
         run: |
           cmake -G 'Unix Makefiles' -S "$GITHUB_WORKSPACE" -B build \
@@ -128,7 +90,6 @@ jobs:
             -DOPENSSL_USE_STATIC_LIBS=TRUE \
             -DCURL_USE_STATIC_LIBS=TRUE \
             -DCMAKE_EXE_LINKER_FLAGS="-static -s"
-        #-DOPENSSL_ROOT_DIR="${OPENSSL_PREFIX}" \
 
       - name: Build
         run: cmake --build build

From 2886c34a45b5bc0bd570b16284e5e13af359720a Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:10:43 -0700
Subject: [PATCH 13/22] ci: allow triggering with specific commit

---
 .github/workflows/release.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c67af06..30e5f6c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -77,6 +77,9 @@ jobs:
           python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
+          fetch-depth: 0
 
       - name: Resolve version
         run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
@@ -185,6 +188,9 @@ jobs:
           make install
 
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
+          fetch-depth: 0
 
       - name: Resolve version
         run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
@@ -308,6 +314,9 @@ jobs:
       VCPKG_ROOT: C:/vcpkg
     steps:
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
+          fetch-depth: 0
 
       - name: Resolve version
         shell: bash

From a2cfd47233e7c53453d37ec53e7912cbf375ed5e Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:13:22 -0700
Subject: [PATCH 14/22] ci: fix missing cryptography python package

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 30e5f6c..5b6967f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,7 +63,7 @@ jobs:
         run: |
           apk add --update --no-cache \
             git bash build-base cmake ninja \
-            python3 py3-pip openssl \
+            python3 py3-cryptography py3-pip openssl \
             openssl-dev openssl-libs-static \
             curl-dev curl-static wget tar perl \
             zlib-dev zlib-static linux-headers \

From f5056cd1e5c752d1d485006f5763fcc5473d6193 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:38:00 -0700
Subject: [PATCH 15/22] ci: apply windows arm patch to older commits

---
 .../patches/cetcompat-arch-guard.patch        | 15 +++++++++++
 .github/workflows/release.yml                 | 25 +++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 .github/workflows/patches/cetcompat-arch-guard.patch

diff --git a/.github/workflows/patches/cetcompat-arch-guard.patch b/.github/workflows/patches/cetcompat-arch-guard.patch
new file mode 100644
index 0000000..2f955be
--- /dev/null
+++ b/.github/workflows/patches/cetcompat-arch-guard.patch
@@ -0,0 +1,15 @@
+diff --git a/cmake/SetCompilerFlags.cmake b/cmake/SetCompilerFlags.cmake
+index 478f824..affab57 100644
+--- a/cmake/SetCompilerFlags.cmake
++++ b/cmake/SetCompilerFlags.cmake
+@@ -59,7 +59,9 @@ function(add_compile_flags target)
+         # Create terminal server aware application (default on)
+         target_link_options(${target} PRIVATE /TSAWARE)
+         # Mark the binary as compatible with Intel Control-flow Enforcement Technology (CET) Shadow Stack
+-        target_link_options(${target} PRIVATE /CETCOMPAT)
++        if(MSVC_C_ARCHITECTURE_ID MATCHES "^(X86|x64|AMD64)$")
++            target_link_options(${target} PRIVATE /CETCOMPAT)
++        endif()
+         # Enable compiler generation of Control Flow Guard security checks
+         target_compile_options(${target} PRIVATE /guard:cf)
+         target_link_options(${target} PRIVATE /guard:cf)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5b6967f..1fd85ae 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -317,6 +317,31 @@ jobs:
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
+      - name: Checkout patch (from workflow ref)
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref }} # the release branch/ref, has the patch
+          sparse-checkout: .github/workflows/patches
+          sparse-checkout-cone-mode: false
+          path: ci-patches
+
+      - name: Apply CETCOMPAT arch guard (ARM64 only)
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Skip if the tag already contains the fix
+          if grep -qE 'MSVC_C_ARCHITECTURE_ID MATCHES' cmake/SetCompilerFlags.cmake;  then
+            echo "Fix already present; nothing to patch."
+            exit 0
+          fi
+          if git apply --3way --check ci-patches/.github/workflows/patches/cetcompat-arch-guard.patch 2>/dev/null; then
+            git apply --3way ci-patches/.github/workflows/patches/cetcompat-arch-guard.patch
+            echo "Patch applied cleanly."
+          else
+            echo "Context mismatch on this tag; falling back to in-place guard."
+            perl -0pi -e 's{(\s*)target_link_options\(\$\{target\} PRIVATE /CETCOMPAT\)}{$1if(MSVC_C_ARCHITECTURE_ID MATCHES "^(X86|x64|AMD64)\$")\n$1 target_link_options(\$\{target\} PRIVATE /CETCOMPAT)\n$1endif()}g' cmake/SetCompilerFlags.cmake
+          fi
+          git --no-pager diff -- cmake/SetCompilerFlags.cmake || true
 
       - name: Resolve version
         shell: bash

From ddcb8e019fd02308579ed5b1a1dfa99ae9e72529 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:33:33 -0700
Subject: [PATCH 16/22] ci: handle release creation better

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1fd85ae..832fa10 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -453,8 +453,8 @@ jobs:
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           name: ${{ github.event.inputs.tag || github.ref_name }}
-          draft: false
-          prerelease: ${{ contains(github.ref_name, '-') }}
+          draft: true
+          prerelease: ${{ contains(github.event.inputs.tag || github.ref_name, '-') }}
           generate_release_notes: true
           fail_on_unmatched_files: true
           files: |

From 366235c50e153ec453bbda5a6fbed59f76fd277b Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:16:59 -0700
Subject: [PATCH 17/22] ci: fix windows job names + move to using fail-fast

---
 .github/workflows/release.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 832fa10..4cc75d1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,7 +43,7 @@ jobs:
   linux:
     name: linux-${{ matrix.arch }}
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - arch: amd64
@@ -145,7 +145,7 @@ jobs:
   macos:
     name: macos-${{ matrix.arch }}
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - arch: arm64
@@ -294,9 +294,9 @@ jobs:
   # self-contained .exe (no vcredist / no third-party DLLs).
   # --------------------------------------------------------------------------
   windows:
-    name: windows
+    name: windows-${{matrix.arch}}
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
           - arch: arm64

From 07a8fdc2cb0b903602570b145024126cad68f406 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Tue, 25 Aug 2026 08:40:10 -0700
Subject: [PATCH 18/22] ci: remove dependence on curl since using openssl >=3

---
 .github/workflows/release.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4cc75d1..aeb4c73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,7 +65,7 @@ jobs:
             git bash build-base cmake ninja \
             python3 py3-cryptography py3-pip openssl \
             openssl-dev openssl-libs-static \
-            curl-dev curl-static wget tar perl \
+            wget tar perl \
             zlib-dev zlib-static linux-headers \
             nghttp2-static brotli-static zstd-static \
             libidn2-static c-ares-static libpsl-static libunistring-static
@@ -91,7 +91,6 @@ jobs:
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE \
-            -DCURL_USE_STATIC_LIBS=TRUE \
             -DCMAKE_EXE_LINKER_FLAGS="-static -s"
 
       - name: Build
@@ -251,7 +250,7 @@ jobs:
         run: |
           bin="build/osslsigncode"
           otool -L "$bin"
-          if otool -L "$bin" | grep -Ei 'vcpkg|Cellar|libssl|libcrypto|libcurl'; then
+          if otool -L "$bin" | grep -Ei 'vcpkg|Cellar|libssl|libcrypto'; then
             echo "::error::binary links a non-system dylib"
             exit 1
           fi

From c150d5972270c006721daf03aa2c638851a06bc1 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Tue, 25 Aug 2026 08:41:04 -0700
Subject: [PATCH 19/22] ci: target oldest version of osx in support (14)

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aeb4c73..b2cce4b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -235,6 +235,7 @@ jobs:
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
+            -DCMAKE_OSX_DEPLOYMENT_TARGET="14.0" \
             -DZLIB_ROOT="${{env.ZLIB_PREFIX}}" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE

From 5e7d86964fa7ccbb4f4625e30561227a99f722c3 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Tue, 25 Aug 2026 08:56:03 -0700
Subject: [PATCH 20/22] ci: once over on documentation and style

Also adjusted ordering of steps to move checkout after build tool setup.
---
 .github/workflows/release.yml | 123 ++++++++++++++++++----------------
 1 file changed, 65 insertions(+), 58 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b2cce4b..6496568 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,18 +1,15 @@
 name: Release
 
-# Build portable, release-grade binaries for every supported architecture on a
+# Build portable, release binaries for every supported architecture on a
 # version tag, then attach them (plus a SHA256SUMS.txt for pinning) to the
 # GitHub release.
 #
 #   Linux   -> fully-static musl binaries (zero shared-lib deps), built in
 #              Alpine on native amd64 and arm64 runners.
-#   macOS   -> arm64 + x86_64, third-party libs (OpenSSL/curl/zlib) linked
+#   macOS   -> arm64 + x86_64, third-party libs (OpenSSL/zlib) linked
 #              statically via vcpkg; only system libs remain dynamic.
-#   Windows -> x64 static (MSVC static CRT + static deps) -> single self
+#   Windows -> arm64 + x64 static (MSVC static CRT + static deps) -> single self
 #              contained .exe.
-#
-# The Linux artifacts are what a hermetic Bazel `ctx.download` repo rule wants:
-# a self-contained binary that runs anywhere, verified with a pinned sha256.
 
 on:
   push:
@@ -36,9 +33,7 @@ permissions:
 jobs:
   # --------------------------------------------------------------------------
   # Linux: fully-static musl binaries. Alpine is the canonical place static
-  # linking of OpenSSL + curl + zlib "just works", because musl has no NSS
-  # dlopen machinery -- so getaddrinfo() for timestamp/CRL servers still works
-  # in a 100% static binary (unlike static glibc).
+  # linking of OpenSSL + zlib
   # --------------------------------------------------------------------------
   linux:
     name: linux-${{ matrix.arch }}
@@ -55,9 +50,14 @@ jobs:
     runs-on: ${{ matrix.os }}
     container: alpine:3.20
     steps:
+      # Handle github actions shenanigans on linux alpine arm
       - uses: laverdet/alpine-arm64@v1
         if: matrix.arch == 'arm64'
 
+      # Get the version currently being built
+      - name: Resolve version
+        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
+
       - name: Install system packages
         shell: sh
         run: |
@@ -70,20 +70,20 @@ jobs:
             nghttp2-static brotli-static zstd-static \
             libidn2-static c-ares-static libpsl-static libunistring-static
 
+      # Ensure the cryptography package is available
       - name: Validate Python Setup
         run: |
           python -c "import sys; print(sys.executable)"
           python --version
           python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
+      # Checkout the specific tag/reference the run is targeting (for back
+      # porting).
       - uses: actions/checkout@v5
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
 
-      - name: Resolve version
-        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
-
       - name: Configure
         run: |
           cmake -G 'Unix Makefiles' -S "$GITHUB_WORKSPACE" -B build \
@@ -162,14 +162,19 @@ jobs:
       VCPKG_ROOT: /usr/local/share/vcpkg
       ZLIB_VERSION: 1.3.1
       ZLIB_PREFIX: /tmp/zlibinstall
+      MIN_MACOS_VERSION: "14.0"
     steps:
+      - name: Resolve version
+        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
+
+      # Macos doesn't have a static zlib build available (at least I couldn't
+      # figure out how to get one), so build and cache it.
       - name: Restore cached ZLib
         id: cache-zlib
         uses: actions/cache@v4
         with:
           path: "${{env.ZLIB_PREFIX}}"
           key: zlib-${{ env.ZLIB_VERSION }}-static-${{ matrix.arch }}-macos
-
       - name: Build ZLib
         if: steps.cache-zlib.outputs.cache-hit != 'true'
         shell: sh
@@ -186,19 +191,14 @@ jobs:
           make -j"$(sysctl -n hw.ncpu)"
           make install
 
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.inputs.tag || github.ref_name }}
-          fetch-depth: 0
-
-      - name: Resolve version
-        run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
-
+      # Setup xcode build environment
       - name: Install Xcode (macOS)
         uses: maxim-lobanov/setup-xcode@v1
         with:
           xcode-version: latest-stable
 
+      # By default cmake 4.0+ is used. However, this project targets a min
+      # version of 3.17.
       - name: Setup the oldest supported version of cmake (macOS)
         uses: jwlawson/actions-setup-cmake@v2.2.0
 
@@ -228,6 +228,13 @@ jobs:
           key: release-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
           restore-keys: release-${{ matrix.triplet }}-
 
+      # Checkout the specific tag/reference the run is targeting (for back
+      # porting).
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
+          fetch-depth: 0
+
       - name: Configure
         run: |
           source venv/bin/activate
@@ -235,14 +242,11 @@ jobs:
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
-            -DCMAKE_OSX_DEPLOYMENT_TARGET="14.0" \
+            -DCMAKE_OSX_DEPLOYMENT_TARGET="${{env.MIN_MACOS_VERSION}}" \
             -DZLIB_ROOT="${{env.ZLIB_PREFIX}}" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE
 
-        #-DVCPKG_TARGET_TRIPLET="${{ matrix.triplet }}" \
-        #-DCMAKE_TOOLCHAIN_FILE="$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" \
-
       - name: Build
         run: |
           cmake --build "${{github.workspace}}/build" --config "$BUILD_TYPE"
@@ -290,7 +294,7 @@ jobs:
           if-no-files-found: error
 
   # --------------------------------------------------------------------------
-  # Windows: x64, MSVC static triplet -> static CRT + static deps -> a single
+  # Windows: x64 + arm64, MSVC static triplet -> static CRT + static deps -> a single
   # self-contained .exe (no vcredist / no third-party DLLs).
   # --------------------------------------------------------------------------
   windows:
@@ -313,36 +317,6 @@ jobs:
     env:
       VCPKG_ROOT: C:/vcpkg
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.inputs.tag || github.ref_name }}
-          fetch-depth: 0
-      - name: Checkout patch (from workflow ref)
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ github.ref }} # the release branch/ref, has the patch
-          sparse-checkout: .github/workflows/patches
-          sparse-checkout-cone-mode: false
-          path: ci-patches
-
-      - name: Apply CETCOMPAT arch guard (ARM64 only)
-        shell: bash
-        run: |
-          set -euo pipefail
-          # Skip if the tag already contains the fix
-          if grep -qE 'MSVC_C_ARCHITECTURE_ID MATCHES' cmake/SetCompilerFlags.cmake;  then
-            echo "Fix already present; nothing to patch."
-            exit 0
-          fi
-          if git apply --3way --check ci-patches/.github/workflows/patches/cetcompat-arch-guard.patch 2>/dev/null; then
-            git apply --3way ci-patches/.github/workflows/patches/cetcompat-arch-guard.patch
-            echo "Patch applied cleanly."
-          else
-            echo "Context mismatch on this tag; falling back to in-place guard."
-            perl -0pi -e 's{(\s*)target_link_options\(\$\{target\} PRIVATE /CETCOMPAT\)}{$1if(MSVC_C_ARCHITECTURE_ID MATCHES "^(X86|x64|AMD64)\$")\n$1 target_link_options(\$\{target\} PRIVATE /CETCOMPAT)\n$1endif()}g' cmake/SetCompilerFlags.cmake
-          fi
-          git --no-pager diff -- cmake/SetCompilerFlags.cmake || true
-
       - name: Resolve version
         shell: bash
         run: echo "VERSION=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_ENV"
@@ -352,15 +326,14 @@ jobs:
         with:
           arch: ${{matrix.vs_arch}}
 
+      # Python setup
       - uses: actions/setup-python@v6
         with:
           python-version: '3.13'
           architecture: x64
-
       - name: Set up Python virtual environment
         run: |
           python -m venv --system-site-packages --copies venv
-
       - name: Install test dependency (cryptography)
         run: |
           .\venv\Scripts\Activate.ps1
@@ -378,6 +351,40 @@ jobs:
           key: release-${{matrix.triplet}}-windows-static-${{ hashFiles('vcpkg.json') }}
           restore-keys: release-${{matrix.triplet}}-windows-static-
 
+      # Checkout the specific tag/reference the run is targeting (for back
+      # porting).
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
+          fetch-depth: 0
+
+      # Handle the CETCOMPAT patch for older versions to support building
+      # past tags.
+      - name: Checkout patch (from workflow ref)
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref }} # the release branch/ref, has the patch
+          sparse-checkout: .github/workflows/patches
+          sparse-checkout-cone-mode: false
+          path: ci-patches
+      - name: Apply CETCOMPAT arch guard
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Skip if the tag already contains the fix
+          if grep -qE 'MSVC_C_ARCHITECTURE_ID MATCHES' cmake/SetCompilerFlags.cmake;  then
+            echo "Fix already present; nothing to patch."
+            exit 0
+          fi
+          if git apply --3way --check ci-patches/.github/workflows/patches/cetcompat-arch-guard.patch 2>/dev/null; then
+            git apply --3way ci-patches/.github/workflows/patches/cetcompat-arch-guard.patch
+            echo "Patch applied cleanly."
+          else
+            echo "Context mismatch on this tag; falling back to in-place guard."
+            perl -0pi -e 's{(\s*)target_link_options\(\$\{target\} PRIVATE /CETCOMPAT\)}{$1if(MSVC_C_ARCHITECTURE_ID MATCHES "^(X86|x64|AMD64)\$")\n$1 target_link_options(\$\{target\} PRIVATE /CETCOMPAT)\n$1endif()}g' cmake/SetCompilerFlags.cmake
+          fi
+          git --no-pager diff -- cmake/SetCompilerFlags.cmake || true
+
       - name: Configure
         run: |
           .\venv\Scripts\Activate.ps1

From 05fb8f33ff7d2a28958b99a274d4abbdbd134d82 Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:05:12 -0700
Subject: [PATCH 21/22] ci: update step actions to their latest available
 version

---
 .github/workflows/release.yml | 36 +++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6496568..d83b916 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,7 +79,7 @@ jobs:
 
       # Checkout the specific tag/reference the run is targeting (for back
       # porting).
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
@@ -112,7 +112,7 @@ jobs:
           ctest --output-on-failure -C "$BUILD_TYPE"
 
       - name: Upload the errors
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: errors-${{matrix.os}}
@@ -130,7 +130,7 @@ jobs:
           tar -C stage -czf "${asset}.tar.gz" "${asset}"
           sha256sum "${asset}.tar.gz"
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: dist-linux-${{ matrix.arch }}
           path: osslsigncode-*-linux-*.tar.gz
@@ -171,7 +171,7 @@ jobs:
       # figure out how to get one), so build and cache it.
       - name: Restore cached ZLib
         id: cache-zlib
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: "${{env.ZLIB_PREFIX}}"
           key: zlib-${{ env.ZLIB_VERSION }}-static-${{ matrix.arch }}-macos
@@ -200,9 +200,9 @@ jobs:
       # By default cmake 4.0+ is used. However, this project targets a min
       # version of 3.17.
       - name: Setup the oldest supported version of cmake (macOS)
-        uses: jwlawson/actions-setup-cmake@v2.2.0
+        uses: jwlawson/actions-setup-cmake@v2
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.13'
           update-environment: false
@@ -222,7 +222,7 @@ jobs:
           python -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
       - name: Cache vcpkg archives
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: /Users/runner/.cache/vcpkg/archives
           key: release-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
@@ -230,7 +230,7 @@ jobs:
 
       # Checkout the specific tag/reference the run is targeting (for back
       # porting).
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
@@ -268,7 +268,7 @@ jobs:
           ctest --output-on-failure -C "$BUILD_TYPE"
 
       - name: Upload the errors
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: errors-${{matrix.os}}
@@ -287,7 +287,7 @@ jobs:
           (cd stage && zip -r "../${asset}.zip" "${asset}")
           shasum -a 256 "${asset}.zip"
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: dist-macos-${{ matrix.arch }}
           path: osslsigncode-*-macos-*.zip
@@ -327,7 +327,7 @@ jobs:
           arch: ${{matrix.vs_arch}}
 
       # Python setup
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.13'
           architecture: x64
@@ -345,7 +345,7 @@ jobs:
           python.exe -c "import cryptography; print(f'Python3 cryptography version {cryptography.__version__}')"
 
       - name: Cache vcpkg archives
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: C:/Users/runneradmin/AppData/Local/vcpkg/archives
           key: release-${{matrix.triplet}}-windows-static-${{ hashFiles('vcpkg.json') }}
@@ -353,7 +353,7 @@ jobs:
 
       # Checkout the specific tag/reference the run is targeting (for back
       # porting).
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
@@ -361,7 +361,7 @@ jobs:
       # Handle the CETCOMPAT patch for older versions to support building
       # past tags.
       - name: Checkout patch (from workflow ref)
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }} # the release branch/ref, has the patch
           sparse-checkout: .github/workflows/patches
@@ -407,7 +407,7 @@ jobs:
           ctest -C ${{ env.BUILD_TYPE }} --output-on-failure
 
       - name: Upload the errors
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: errors-${{matrix.os}}
@@ -427,7 +427,7 @@ jobs:
           (cd stage && 7z a -tzip "../${asset}.zip" "${asset}")
           sha256sum "${asset}.zip"
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: dist-windows-${{matrix.arch}}
           path: osslsigncode-*-windows-*.zip
@@ -443,7 +443,7 @@ jobs:
       contents: write   # required to create/modify the release
     steps:
       - name: Download all build artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true
@@ -456,7 +456,7 @@ jobs:
           cat SHA256SUMS.txt
 
       - name: Create / update the GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           name: ${{ github.event.inputs.tag || github.ref_name }}

From 669d7b55d48e6e8e7ac49a0c0fc7eb28884ebd9e Mon Sep 17 00:00:00 2001
From: EliSauder <24995216+EliSauder@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:09:51 -0700
Subject: [PATCH 22/22] ci: move from python venv

---
 .github/workflows/release.yml | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d83b916..ebaee7b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -205,16 +205,10 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: '3.13'
-          update-environment: false
           architecture: ${{matrix.py_arch}}
 
-      - name: Set up Python virtual environment
-        run: |
-          python -m venv --system-site-packages --copies venv
-
       - name: Install test dependency (cryptography)
         run: |
-          source venv/bin/activate
           python -m pip install --upgrade pip
           ARCHFLAGS="-arch ${{ matrix.osx_arch }}" python -m pip install --upgrade cryptography
           python -c "import sys; print(sys.executable)"
@@ -237,7 +231,6 @@ jobs:
 
       - name: Configure
         run: |
-          source venv/bin/activate
           cmake -G "Unix Makefiles" -S "${{github.workspace}}" -B "${{github.workspace}}/build" \
             -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
@@ -264,7 +257,6 @@ jobs:
       - name: Test
         working-directory: build
         run: |
-          source ../venv/bin/activate
           ctest --output-on-failure -C "$BUILD_TYPE"
 
       - name: Upload the errors
@@ -331,12 +323,8 @@ jobs:
         with:
           python-version: '3.13'
           architecture: x64
-      - name: Set up Python virtual environment
-        run: |
-          python -m venv --system-site-packages --copies venv
       - name: Install test dependency (cryptography)
         run: |
-          .\venv\Scripts\Activate.ps1
           python -m ensurepip
           python -m pip install --upgrade pip
           python -m pip install --upgrade pip cryptography
@@ -387,7 +375,6 @@ jobs:
 
       - name: Configure
         run: |
-          .\venv\Scripts\Activate.ps1
           cmake -G Ninja -S "${{ github.workspace }}" -B build `
             -DCMAKE_BUILD_TYPE="${{ env.BUILD_TYPE }}" `
             -DCMAKE_INSTALL_PREFIX="${{ github.workspace }}/dist" `
@@ -403,7 +390,6 @@ jobs:
       - name: Test
         working-directory: build
         run: |
-          ..\venv\Scripts\Activate.ps1
           ctest -C ${{ env.BUILD_TYPE }} --output-on-failure
 
       - name: Upload the errors