Integrate SignPath for automated Windows code signing (#1479)

* Sign Windows installer via SignPath

* Update policy

* Update README.md

* Update README.md

Author: awawa-dev

.github/workflows/push-master.yml

@@ -2,7 +2,6 @@ name: HyperHDR CI Build
 
 on:
   push:
-  pull_request:
 
 env:
     USE_CACHE: ${{ vars.USE_CACHE && vars.USE_CACHE || true }}
@@ -235,19 +234,91 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
+      - name: Upload unsigned artifacts
+        uses: actions/upload-artifact@v7.0.0
+        with:
+          name: unsigned-windows-installer
+          path: build/Hyper*
+          retention-days: 1
+
+################################
+###### Sign Windows ############
+################################
+
+  sign-windows:
+    name: Sign Windows Installer
+    needs: [windows]
+    runs-on: ubuntu-24.04
+    env:
+      USE_SIGNPATH: ${{ vars.USE_SIGNPATH || 'false' }}
+    steps:
+      - name: Download unsigned artifact
+        uses: actions/download-artifact@v8.0.0
+        with:
+          name: unsigned-windows-installer
+          path: to_sign
+
+      - name: Check SignPath Secrets
+        if: env.USE_SIGNPATH == 'true' && github.event_name != 'pull_request'
+        env:
+          SIGNPATH_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
+          SIGNPATH_ORGANIZATION_ID: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
+        run: |
+          if [ -z "$SIGNPATH_TOKEN" ] || [ -z "$SIGNPATH_ORGANIZATION_ID" ]; then
+            echo "USE_SIGNPATH=false" >> $GITHUB_ENV
+            echo "SignPath secrets not found. Skipping signing process."
+          fi
+
+      - name: Upload unsigned ZIP to GitHub (SignPath V2 requirement)
+        if: ${{ env.USE_SIGNPATH == 'true' }}
+        id: upload-unsigned-artifact
+        uses: actions/upload-artifact@v7.0.0
+        with:
+          name: signpath_upload
+          path: to_sign/
+          retention-days: 1
+
+      - name: Sign artifact with SignPath
+        if: env.USE_SIGNPATH == 'true'
+        id: signpath_step
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: 'hyperhdr'
+          signing-policy-slug: ${{ startsWith(github.ref, 'refs/tags/') && 'release-signing' || 'test-signing' }}
+          github-artifact-id: ${{ steps.upload-unsigned-artifact.outputs.artifact-id }}
+          wait-for-completion: true
+          output-artifact-directory: signed_artifact
+
+      - name: Check SignPath result & fail if needed
+        if: always() && env.USE_SIGNPATH == 'true'
+        run: |
+          if [ "${{ steps.signpath_step.outcome }}" != "success" ]; then
+            echo "::error::SignPath action failed technically (check logs for timeout/network issues)."
+            exit 1
+          fi
+          
+          if [ ! -d "signed_artifact" ] || [ -z "$(ls -A signed_artifact 2>/dev/null)" ]; then
+            echo "::error::SignPath reported success, but NO signed artifacts were downloaded!"
+            echo "This usually means the signing request was REJECTED or failed silently."
+            exit 1
+          fi          
+          echo "Signing successful. Artifacts found in 'signed_artifact'."
+          
       - name: Upload artifacts (release)
         if: startsWith(github.event.ref, 'refs/tags') && github.event_name != 'pull_request'
         uses: actions/upload-artifact@v7.0.1
         with:
           name: release-artifact-windows
-          path: build/Hyper*
+          path: ${{ env.USE_SIGNPATH == 'true' && 'signed_artifact' || 'to_sign' }}/Hyper*.exe
 
       - name: Upload artifacts from commit
         if: startsWith(github.event.ref, 'refs/tags') == false && github.event_name != 'pull_request'
         uses: actions/upload-artifact@v7.0.1
         with:
-          name: Windows_x64_setup
-          path: build/Hyper*.exe
+          name: Windows_x64_setup_${{ env.USE_SIGNPATH == 'true' && 'signed' || 'unsigned' }}
+          path: ${{ env.USE_SIGNPATH == 'true' && 'signed_artifact' || 'to_sign' }}/Hyper*.exe
 
 ################################
 ####### CodeQL support #########
@@ -357,7 +428,7 @@ jobs:
   publish:
     name: Publish Releases
     if: startsWith(github.event.ref, 'refs/tags') && github.event_name != 'pull_request'
-    needs: [Linux, windows, macOS]
+    needs: [Linux, sign-windows, macOS]
     runs-on: ubuntu-24.04
     permissions:
       contents: write

CODE_SIGNING_POLICY.md

@@ -0,0 +1,13 @@
+# Code Signing Policy
+
+Free code signing for Windows is provided by [SignPath.io](https://about.signpath.io), certificate by [SignPath Foundation](https://signpath.org).
+
+The HyperHDR Windows installer (.exe) for stable and test releases is signed with this certificate.
+
+### Team roles
+- **Authors / Committers**: [awawa-dev](https://github.com/awawa-dev) and other contributors
+- **Reviewers**: [awawa-dev](https://github.com/awawa-dev)
+- **Approvers**: [awawa-dev](https://github.com/awawa-dev)
+
+### Privacy policy
+This program will not transfer any information to other networked systems unless requested by the user or the person installing or operating it.

README.md

@@ -2,7 +2,7 @@
 
 ## About
 
-HyperHDR is an open-source ambient lighting system for TVs and music setups, based on real-time video and audio stream analysis. It is designed with a strong focus on stability, high performance, and high-fidelity video decoding and mapping for precise and vibrant LED visuals. Optimized for both single-threaded and multi-threaded video processing, HyperHDR runs seamlessly on **Windows**, **macOS** (x64/arm64: M1, M2), and **Linux x64 & ARM** (including Raspberry Pi).
+HyperHDR is an open-source ambient lighting system for TVs and music setups. It performs real-time analysis of video and audio streams to create immersive LED lighting. Designed with a strong focus on stability, high performance, and high-fidelity video decoding and mapping, HyperHDR delivers precise and vibrant LED visuals. Optimized for both single- and multi-threaded video processing, it runs seamlessly on **Windows**, **macOS** (x64 & arm64), and **Linux** (x64 & ARM, including Raspberry Pi).
 
 ![v20](https://github.com/awawa-dev/HyperHDR/assets/69086569/9bc7999d-1515-4a96-ba5e-8a732cf7d8a4)
 
@@ -15,8 +15,8 @@ The Infinite Color Engine has also paved the way for our bespoke, internally dev
 ### Key advantages of the Infinite Color Engine ( :new: HyperHDR v22):
 * **Floating-Point Precision:** All color computations use high-precision floating-point arithmetic, eliminating cumulative rounding errors for more accurate results
 * **Linear sRGB Accuracy:** Core color transformations are processed in linear sRGB space, ensuring physically correct and consistent light reproduction
-* **Deep-Color Support:** Compatible devices, including Philips Hue lamps, LIFX and HD108 LEDs, can take advantage of rendering beyond standard 24-bit RGB color depth.
-* **Advanced color smoothing algorithms:** Inertia-based physics, exponential, and perceptually-uniform YUV/RGB interpolators for more fluid and natural color transitions
+* **Deep-Color Support:** Compatible devices, including Philips Hue lamps, LIFX and HD108 LEDs, can take advantage of rendering beyond standard 24-bit RGB color depth
+* **Advanced Color Smoothing Algorithms:** Inertial-physics, exponential, and perceptually-uniform YUV/RGB interpolators for more fluid and natural color transitions
 * **High-precision RGB-to-RGBW conversion:** Energy-aware power balancing, white point temperature calibration, temporal dithering and anti-flicker hysteresis
 
 ### Additional features:
@@ -26,39 +26,43 @@ The Infinite Color Engine has also paved the way for our bespoke, internally dev
 * **Optimized multithreading**, enabling Raspberry Pi to process high-quality video streams  
 * **High portability** across ARM-based embedded platforms  
 * **System diagnostics:** live CPU/RAM usage, CPU temperature, undervoltage detection, USB grabber and LED performance  
-* **USB grabber support** for Linux, Windows 10/11, and macOS for P010/NV12/YUYV/MJPEG/UYVY/I420/RGB   
+* **USB grabber support** on Linux, Windows 10/11, and macOS for P010/NV12/YUYV/MJPEG/UYVY/I420/RGB   
 * **Hardware-accelerated capture:** PipeWire/Portal (Linux/Wayland), DirectX (Windows 10/11)  
 * **HDR-ready DirectX screen grabbing:** Supports DXGI_FORMAT_R16G16B16A16_FLOAT and multiple monitors 
-* **Optimized video processing:** Our optimized pipeline handles smoothly 1080p **P010**/**NV12**/**YUYV** even on Rpi4
+* **Optimized video processing:** Our pipeline smoothly handles 1080p **P010**/**NV12**/**YUYV** even on Rpi4
 * **Built-in audio visualization** powered by spectrum analysis  
 * **MQTT support** for IoT integration  
 * **Home Assistant and zigbee2mqtt integration**  
 * **Automatic tone mapping** for SDR/HDR content  
 * **Automatic LUT calibration** for optimal HDR/SDR grabber quality using MP4 test files  
 * **Latency benchmarking** for USB grabbers  
-* **P010 support** for Windows, Linux: our patched Raspberry Pi OS image (P010 is unsupported in mainline OS)
+* **P010 support** on Windows & Linux (our patched Raspberry Pi OS image - P010 is not supported in mainline OS)
 * **Intuitive LED strip editor**, with automatic or manual geometry editing via mouse and context menus  
 * **Smart signal detection** with adaptive learning for USB grabbers  
 * **External tone mapping support** for flatbuffers/protobuf sources  
-* **Wide LED strip compatibility** and for WS281x, APA102, HD107, SK9822, SK6812 our ultra-fast LED controllers:  
-  * [HyperSPI](https://github.com/awawa-dev/HyperSPI) for ESP8266/ESP32/rp2040  
+* **Wide LED strip compatibility** including WS281x, APA102, HD107, SK9822, SK6812 and our ultra-fast LED controllers:  
+  * [HyperSPI](https://github.com/awawa-dev/HyperSPI) for ESP8266/ESP32/RP2040  
   * [HyperSerialEsp8266](https://github.com/awawa-dev/HyperSerialEsp8266), [HyperSerialESP32](https://github.com/awawa-dev/HyperSerialESP32), [HyperSerialPico](https://github.com/awawa-dev/HyperSerialPico) USB serial port 2Mb+ speed connection    
-  * :new: [Hyperk](https://github.com/awawa-dev/Hyperk): our optimized wireless LED controller for esp8266/ESP32 (inc. S2/S3/C2/C3/C5/C6) and Raspberry Pi Pico W (rp2040/rp2350) family
+  * :new: [Hyperk](https://github.com/awawa-dev/Hyperk): our optimized wireless LED controller for ESP8266/ESP32 (incl. S2/S3/C2/C3/C5/C6) and Raspberry Pi Pico W (RP2040/RP2350) family
 
-HyperHDR’s advanced video pipeline significantly enhances LED output, creating a smoother, more immersive ambient lighting experience. It works with SDR, HDR, and Dolby Vision (LLDV if supported by your hardware). Instead of relying on USB grabbers, you can also use software screen capture directly from your PC.  
+HyperHDR’s advanced video pipeline significantly enhances LED output, creating a smoother, more immersive ambient lighting experience. It works with SDR, HDR, and Dolby Vision (Low Latency Dolby Vision / LLDV only, if supported by your hardware). Instead of relying on USB grabbers, you can also use software screen capture directly from your PC.  
 
 ![example](https://github.com/awawa-dev/HyperHDR/assets/69086569/4077c05d-4c02-47eb-8d64-a334064403b3)
 
 ## Downloads
 
-Official releases:  
+**Official releases:**  
 [https://github.com/awawa-dev/HyperHDR/releases](https://github.com/awawa-dev/HyperHDR/releases)
 
-Official Linux repository:  
+Windows installers are code-signed by [SignPath Foundation](https://signpath.org). See our [Code Signing Policy](CODE_SIGNING_POLICY.md).
+
+**Official Linux repository:**  
 [https://awawa-dev.github.io/](https://awawa-dev.github.io/)
 
-Latest test builds (GitHub Action — login required, select latest build from master branch, setups in ZIP artifacts):  
-![Latest build on master](https://github.com/awawa-dev/HyperHDR/actions?query=branch%3Amaster)
+**Latest test builds** (GitHub Actions):  
+[View latest builds on master branch](https://github.com/awawa-dev/HyperHDR/actions?query=event:push+branch:master)
+
+Login required → select the latest build from the **master** branch → download setups from the ZIP artifacts.
 
 ## Documentation