| 1 | <?xml version="1.0" encoding="utf-8"?> |
| 2 | <!-- GitHub Actions wraps every uploaded artifact in a zip, so the installer arrives |
| 3 | zipped even though it is a single file — match and sign the .exe inside. --> |
| 4 | <artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1"> |
| 5 | <zip-file> |
| 6 | <pe-file-set> |
| 7 | <include path="*installer*.exe" min-matches="1" max-matches="1" /> |
| 8 | <for-each> |
| 9 | <authenticode-sign /> |
| 10 | </for-each> |
| 11 | </pe-file-set> |
| 12 | </zip-file> |
| 13 | </artifact-configuration> |
| 14 |