Code Signing

How to Protect Your Signing Key

A practical, beginner-friendly guide to how to protect your signing key for independent software developers preparing a trustworthy NeonRoof release. It covers the decisions, evidence, and release checks that matter in code signing.

Release checklist

  1. Use a signing identity controlled by the software publisher, not a shared third-party identity.
  2. Prefer a publicly trusted certificate or managed signing service for public commercial releases.
  3. Sign the final binary, add an RFC 3161 timestamp, and never modify the file afterward.
  4. Verify the signature, certificate chain, timestamp, and SHA-256 digest on a clean Windows machine.
  5. Keep private keys in protected hardware or a managed service and restrict signing permissions.

How to apply this on NeonRoof

Prepare the evidence while you build the release, not after uploading it. Enter the same publisher name, version, architecture, licensing details, and support information everywhere. Submit one final binary, then wait for release-specific certification before making it downloadable.

If a check fails, correct the source or packaging process, increment the release when appropriate, build again from a known revision, and submit the new immutable binary. Never replace a certified file behind the same URL.

Official documentation