Necessary Code Signing

Necessary

Free code signing for open source software. If you maintain an open source project and need proper Authenticode signatures for Windows, you can apply for access to this service. Approved projects are listed publicly on this page.

Publisher Identity: Software signed through this service will display Necessary Innovations AB, Sweden as the publisher in Windows SmartScreen and certificate dialogs.

Projects Using This Service

Request Access

Fill out this form to apply for an API token. Applications are reviewed manually and access is granted to qualifying open source projects.

Terms of Use

By using this service, you agree to the following terms:

Eligibility

Prohibited Use

Service Terms

Contact

For questions or abuse reports, contact the service administrator.

How to Sign a Binary

Signing requires three steps using osslsigncode on your local machine:

Step 1: Extract the data to be signed

osslsigncode extract-data -in myapp.exe -out tosign.bin

Step 2: Send to signing service

curl -X POST \
  -H "Authorization: Bearer YOUR_TOKEN_HERE" \
  --data-binary @tosign.bin \
  https://sign.necessary.nu/windows/sign \
  -o signed.bin

Step 3: Attach signature to your binary

osslsigncode attach-signature -sigin signed.bin -in myapp.exe -out myapp-signed.exe

API Reference

Endpoint: POST /windows/sign

Authentication: Bearer token in the Authorization header

Request: Binary data from osslsigncode extract-data

Response: Signed data to use with osslsigncode attach-signature

Health Check

Endpoint: GET /health

Returns JSON with HSM and certificate availability status.

CI Integration

Never commit your signing token to version control. Use your CI platform's secrets management.

GitHub Actions

- name: Sign binary
  run: |
    osslsigncode extract-data -in build/myapp.exe -out tosign.bin
    curl -X POST \
      -H "Authorization: Bearer ${ secrets.SIGNING_TOKEN }" \
      --data-binary @tosign.bin \
      https://sign.necessary.nu/windows/sign -o signed.bin
    osslsigncode attach-signature -sigin signed.bin -in build/myapp.exe -out build/myapp-signed.exe

GitLab CI

sign:
  script:
    - osslsigncode extract-data -in build/myapp.exe -out tosign.bin
    - curl -X POST -H "Authorization: Bearer $SIGNING_TOKEN" --data-binary @tosign.bin https://sign.necessary.nu/windows/sign -o signed.bin
    - osslsigncode attach-signature -sigin signed.bin -in build/myapp.exe -out build/myapp-signed.exe

Woodpecker CI

steps:
  - name: sign
    image: debian
    commands:
      - osslsigncode extract-data -in build/myapp.exe -out tosign.bin
      - curl -X POST -H "Authorization: Bearer $SIGNING_TOKEN" --data-binary @tosign.bin https://sign.necessary.nu/windows/sign -o signed.bin
      - osslsigncode attach-signature -sigin signed.bin -in build/myapp.exe -out build/myapp-signed.exe
    secrets: [signing_token]