enable windows code signing

.appveyor.yml

@@ -1,8 +1,14 @@
 # Test against the latest version of this Node.js version
 environment:
-  nodejs_version: "7"
+  nodejs_version: 7
   GH_TOKEN:
     secure: LiI5jyuHUw6XbH4kC3gP1HX4P/v4rwD/gCNtaFhQu2AvJz1/1wALkp5ECnIxRySN
+  key_pass:
+    secure: u6DydPcdrUJlxGL9uc7yQRYG8+5rY6aAEE9nfCSzFyNzZlX9NniOp8Uh5ZKQqX7bGEngLI6ipbLfiJvn0XFnhbn2iTkOuMqOXVJVOehvwlQ=
+  pfx_key:
+    secure: 1mwqyRy7hDqDjDK+TIAoaXyXzpNgwruFNA6TPkinUcVM7A+NLD33RQLnfnwVy+R5ovD2pUfhQ6+N0Fqebv6tZh436LIEsock+6IOdpgFwrg=
+  # find with: Get-Childitem –Path "C:\Program Files (x86)\Microsoft SDKs\Windows\" -Include *signtool* -File -Recurse -ErrorAction SilentlyContinue
+  SIGNTOOL_PATH: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\signtool.exe
 
 skip_branch_with_pr: true
 

CHANGELOG.md

@@ -20,6 +20,7 @@ Web UI version numbers should always match the corresponding version of LBRY App
   * Redesigned UI for Discover
   * Handle more of price calculations at the daemon layer to improve page load time
   * Add special support for building channel claims in lbryuri module
+  * Enable windows code signing of binary
 
 ### Changed
   * Update process now easier and more reliable

build/build.ps1

@@ -31,4 +31,10 @@ $binary_name = Get-ChildItem -Path dist -Filter '*.exe' -Name
 $new_name = $binary_name -replace '^LBRY Setup (.*)\.exe$', 'LBRY_$1.exe'
 Rename-Item -Path "dist\$binary_name" -NewName $new_name
 dir dist # verify that binary was built/named correctly
+
+# sign binary
+nuget install secure-file -ExcludeVersion
+secure-file\tools\secure-file -decrypt build\lbry2.pfx.enc -secret "$env:pfx_key"
+& ${env:SIGNTOOL_PATH} sign /f build\lbry2.pfx /p "$env:key_pass" /tr http://tsa.starfieldtech.com /td SHA256 /fd SHA256 dist\*.exe
+
 python build\release_on_tag.py