菜单
Code-sign the MAGDA Windows installer with the Certum cloud certificate (SimplySign). Use when releasing on Windows, when the signing job in release.yml needs attention, or when troubleshooting "cert not found" / SmartScreen warnings.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | windows-signing |
| description | Code-sign the MAGDA Windows installer with the Certum cloud certificate (SimplySign). Use when releasing on Windows, when the signing job in release.yml needs attention, or when troubleshooting "cert not found" / SmartScreen warnings. |
| user_invocable | true |
MAGDA's Windows installer is signed with Authenticode using the Certum "Open Source Developer Luca Romagnoli" certificate (OV class) held in the cloud via SimplySign. There is no Windows "notarization" — that's an Apple concept; on Windows you sign the binary and embed a trusted timestamp.
Because it's OV (not EV), SmartScreen trust builds up gradually as downloads accumulate; it is not instantly clean on day one. Nothing to configure for that.
| Cert thumbprint | 715B3557D43AF8FC23297999C0541C07E1B61319 |
| Issuer | Certum Code Signing 2021 CA |
| Expires | 2027-06-29 |
| Timestamp server | http://time.certum.pl (mandatory) |
| signtool | C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe |
| Signing script | packaging/windows/sign-release.ps1 |
The timestamp keeps signatures valid after the cert expires, so re-signing old builds is never needed.
You need exactly two SimplySign pieces — not SafeSign (that's for physical USB cards):
Cert:\CurrentUser\My.Confirm the cert is reachable:
Get-ChildItem Cert:\CurrentUser\My | Where-Object Thumbprint -eq '715B3557D43AF8FC23297999C0541C07E1B61319' |
Format-List Subject, NotAfter, @{N='HasPrivateKey';E={$_.HasPrivateKey}}
HasPrivateKey : True means signing will work.
SimplySign requires an interactive OTP from the phone each session, so signing cannot run on a GitHub-hosted runner or as a background service — it must run inside the logged-in desktop session where SimplySign Desktop holds the cert. One OTP login covers many signs for the session.
release.yml has a sign-windows job (tag pushes only) on the self-hosted
runner [self-hosted, Windows, magda-luca]. It downloads the unsigned build
artifact, provisions NSIS, unpacks the MuseHub source bundle, and runs
sign-release.ps1 -WaitMinutes 30, then publishes the signed installer via
create-release.
Per-release steps:
NT AUTHORITY\NETWORK SERVICE service — that session can't see the
cert). Either run run.cmd from the runner folder or have it auto-start at
logon.sign-windows job prints "Waiting for SimplySign login…", open
SimplySign Desktop and enter the OTP from your phone. The job proceeds the
instant the cert appears (within the 30-minute window). Order doesn't matter
— you can log in before or after pushing the tag.On a machine logged into SimplySign Desktop, point the script at a staging dir
that holds MAGDA.exe, magda_plugin_scanner.exe and magda-installer.nsi
(an extracted MAGDA-<version>-MuseHub-Source.zip, or a local build's installer
staging dir):
packaging\windows\sign-release.ps1 -StageDir <dir> -Version <x.y.z> -Makensis <path-to-makensis.exe>
It signs both exes, rebuilds the installer (makensis runs with the working
directory set to the stage so OutFile lands there), signs it, verifies the
chain, and writes MAGDA-<version>-Windows-x86_64-Setup.exe + .sha256.
To sign a single file directly:
signtool sign /sha1 715B3557D43AF8FC23297999C0541C07E1B61319 /fd sha256 /tr http://time.certum.pl /td sha256 /v <file>
signtool verify /pa /v <file>
The ONNX Runtime and libxml2 DLLs are vendor-signed already — only sign the two MAGDA exes and the installer.
sign-release.ps1.Work on MAGDA's compiled Faust devices (synths/FX whose DSP is a .dsp file compiled to C++ at build time). Use when adding or changing a parameter on a compiled Faust plugin (e.g. Poly Synth, the filter engines, compiled FX), creating a new compiled Faust device, or wiring its custom UI. Covers the .dsp -> generated.cpp pipeline, the host-slot contract, and UI/linking.
Update the MAGDA application icon (dock / taskbar / window icon) from a new source PNG. Use when the user wants to change, swap, or update the app icon, e.g. "update the app icon to Bold-M6". Covers the assets/app_icon.png pipeline, the square-PNG requirement, and rebuilding so JUCE regenerates the .icns/.ico.
Manage MAGDA translations via Crowdin - how to add source strings, push sources, push a specific locale's translation via CLI, and the rules about who writes what.
Write values from MAGDA into a te::AutomatableParameter (slider moves, controller input, state restore, modifier sync). Covers the setParameterFromHost requirement, why setParameter silently drops host writes when modifiers are active, and what to do after a TE submodule bump. Use when adding a new DeviceProcessor, wiring a new control surface, debugging "slider does nothing when an LFO/macro is on the parameter", or rebasing the TE patch.
Tag and push a release. Use when the user says "release X.Y.Z". Does NOT merge any branches — just tags the current HEAD and pushes.
Analyze MAGDA crash logs and Windows minidumps. Use when the user reports a crash, provides a crash log or .dmp file, or asks to investigate a crash.