authenticode

func VerifyFile ¶

func VerifyFile(ctx context.Context, path string) error

VerifyFile 通过 Windows WinVerifyTrust 验证文件的 Authenticode 签名与系统信任链。

func VerifyFileOrSameSigner ¶

func VerifyFileOrSameSigner(ctx context.Context, path, referencePath string) error

VerifyFileOrSameSigner first applies the normal Windows trust policy.

AgentDock currently still supports releases signed by the existing self-signed project certificate. Windows reports those signatures as CERT_E_UNTRUSTEDROOT. In that one case only, accept the target when the already-installed reference binary has the same trust result and both files carry the exact same signer certificate thumbprint. This pins the update to the publisher identity already installed on the machine instead of trusting an arbitrary self-signed signer.

When releases move to a publicly trusted Authenticode certificate, the normal WinVerifyTrust path succeeds and this compatibility path is bypassed.