From 5b88e66d18f3c5f1bfdabc1ca57a6c9dec933c77 Mon Sep 17 00:00:00 2001
From: Raphael <68374617+raphaelscholle@users.noreply.github.com>
Date: Tue, 3 Nov 2026 17:28:06 +0100
Subject: [PATCH 1/3] Use current SignPath GitHub pipeline connector endpoint

---
 .github/workflows/windows.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 357854439..fbe3a28d3 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -252,6 +252,7 @@ jobs:
       uses: signpath/github-action-submit-signing-request@v3
       with:
         api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+        connector-url: https://pipelineconnector.connectors.signpath.io/GitHub/GitHubCom
         organization-id: ${{ inputs.organization-id }}
         project-slug: ${{ inputs.project-slug }}
         signing-policy-slug: ${{ inputs.signing-policy-slug }}
@@ -302,6 +303,7 @@ jobs:
       uses: signpath/github-action-submit-signing-request@v3
       with:
         api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+        connector-url: https://pipelineconnector.connectors.signpath.io/GitHub/GitHubCom
         organization-id: ${{ inputs.organization-id }}
         project-slug: ${{ inputs.project-slug }}
         signing-policy-slug: ${{ inputs.signing-policy-slug }}

From 120b5e17943ed933ef12f4a1a1d1b00347bb8eee Mon Sep 17 00:00:00 2001
From: Raphael <68374617+raphaelscholle@users.noreply.github.com>
Date: Tue, 3 Nov 2026 17:42:02 +0100
Subject: [PATCH 2/3] Avoid interactive test certificate trust on GitHub
 runners

---
 .github/workflows/windows.yml               | 2 --
 scripts/trust_signpath_test_certificate.ps1 | 5 ++++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index fbe3a28d3..357854439 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -252,7 +252,6 @@ jobs:
       uses: signpath/github-action-submit-signing-request@v3
       with:
         api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
-        connector-url: https://pipelineconnector.connectors.signpath.io/GitHub/GitHubCom
         organization-id: ${{ inputs.organization-id }}
         project-slug: ${{ inputs.project-slug }}
         signing-policy-slug: ${{ inputs.signing-policy-slug }}
@@ -303,7 +302,6 @@ jobs:
       uses: signpath/github-action-submit-signing-request@v3
       with:
         api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
-        connector-url: https://pipelineconnector.connectors.signpath.io/GitHub/GitHubCom
         organization-id: ${{ inputs.organization-id }}
         project-slug: ${{ inputs.project-slug }}
         signing-policy-slug: ${{ inputs.signing-policy-slug }}
diff --git a/scripts/trust_signpath_test_certificate.ps1 b/scripts/trust_signpath_test_certificate.ps1
index 0d67baf21..2eb17ca3d 100644
--- a/scripts/trust_signpath_test_certificate.ps1
+++ b/scripts/trust_signpath_test_certificate.ps1
@@ -23,9 +23,12 @@ try {
     }
     # Only the ephemeral GitHub-hosted test job trusts this public certificate.
     # Release jobs never execute this script and retain normal Windows trust.
+    # The user Root store can show an interactive security prompt.
+    # GitHub-hosted Windows runners are disposable and run as administrator.
     foreach ($storeName in @('Root', 'TrustedPublisher')) {
-        $store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, 'CurrentUser')
+        $store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, 'LocalMachine')
         try {
+            Write-Host "Importing the public test certificate into LocalMachine/$storeName"
             $store.Open('ReadWrite')
             $store.Add($certificate)
         } finally {

From a45c59b7ff2539355f2bacc4724c5008df723dd2 Mon Sep 17 00:00:00 2001
From: Raphael <68374617+raphaelscholle@users.noreply.github.com>
Date: Tue, 3 Nov 2026 17:43:12 +0100
Subject: [PATCH 3/3] Document machine trust restricted to disposable signing
 test runners

---
 doc/signpath.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/signpath.md b/doc/signpath.md
index cde506ee0..598407c4d 100644
--- a/doc/signpath.md
+++ b/doc/signpath.md
@@ -37,8 +37,8 @@ commit (`github.sha`), so the source matches the build's origin metadata.
 ## Test signing and production review
 
 Run with `test` first. Only this ephemeral GitHub-hosted runner imports the
-configured public self-signed test certificate into its current-user trust
-stores. Each signed file must have a valid timestamped signature from exactly
+configured public self-signed test certificate into its machine trust stores
+to avoid interactive user-store prompts. Each signed file must have a valid timestamped signature from exactly
 that certificate. Test outputs are labelled `-Test-Signed`; they are for
 onboarding verification and are not publicly trusted distribution packages.
 Do not install this certificate on end-user computers.