developer-delphi-windows-codesigning

Automate Windows code signing for Delphi by securely handling PFX files and Base64 secrets within your CI/CD pipeline, using signtool to sign binaries and verify signatures without hardcoding credentials. This ensures trusted app distribution.

Self-signed certificates are used for local testing and internal distribution of Delphi apps, while Organization Validation (OV) and Extended Validation (EV) certificates provide production-level trust for publicly distributed Windows applications.

Yes, you can use signtool to sign Free Pascal and Lazarus Windows binaries. The workflow supports both FPC/Lazarus and Delphi applications for signing, timestamping, and verification across local development and CI/CD.

Generate a self-signed test certificate, export it to a PFX file, and install it on your test machine. You can then use signtool to sign your Windows executable and verify the signature locally before production release.

Yes, secure credential handling is enforced during Windows code signing. The process requires proper management of PFX files and Base64 secrets to ensure certificate credentials are not hardcoded in scripts or CI/CD pipelines.

Timestamping is enforced during signtool code signing to ensure the digital signature remains valid even after the certificate expires. Without proper timestamping, signed Delphi binaries may lose trust status over time.