{
 "number": 36673,
 "repo": "bitcoin/bitcoin",
 "url": "https://github.com/bitcoin/bitcoin/pull/36673",
 "title": "[DRAFT] ci: Monitor Windows signing certificate expiry",
 "author": "willcl-ark",
 "author_association": "MEMBER",
 "created_at": "2026-10-27T10:14:31Z",
 "updated_at": "2026-10-30T11:55:45Z",
 "description_hash": "12a20b851842d55b",
 "age_days": 5,
 "draft": true,
 "labels": [
  "Windows"
 ],
 "milestone": null,
 "base": "master",
 "head_sha": "b7e371b634a0b971a9e012124431568fbcc6f194",
 "head_ref": "code-cert-ci",
 "head_repo": "willcl-ark/bitcoin",
 "head_history": [
  {
   "t": "2026-10-27T15:54:54Z",
   "sha": "1760a02463d2952fef48d4872da8d3f0cff583dc"
  },
  {
   "t": "2026-10-29T20:55:29Z",
   "sha": "b7e371b634a0b971a9e012124431568fbcc6f194"
  }
 ],
 "additions": 76,
 "deletions": 0,
 "changed_files": 1,
 "commit_count": 1,
 "size_bucket": "S",
 "mergeable_state": "clean",
 "bot": {
  "drahtbot": {
   "present": true,
   "reviews": {},
   "conflicts": []
  }
 },
 "acks_parsed": {},
 "acks_tally": {
  "ack": 0,
  "stale_ack": 0,
  "concept_ack": 0,
  "approach_ack": 0,
  "nack": 0,
  "concept_nack": 0,
  "approach_nack": 0
 },
 "reviews": {
  "approved": 0,
  "changes_requested": 0,
  "distinct_reviewers": [
   "achow101",
   "fanquake",
   "hebasto",
   "maflcko"
  ]
 },
 "signals": {
  "needs_rebase": false,
  "ci_failed": false,
  "mergeable_state": "clean",
  "last_author_activity": "2026-10-30T10:37:54Z",
  "last_reviewer_activity": "2026-10-30T11:55:45Z",
  "last_reviewer": "maflcko",
  "author_silent_days": 2,
  "waiting_on_author_days": 2,
  "days_since_update": 2
 },
 "refs": {
  "mentioned": [],
  "depends_on": [],
  "fixes": [],
  "linked_issues": [],
  "references": [],
  "conflicts": []
 },
 "stack": {
  "shares_commits_with": [],
  "based_on": [],
  "base_for": []
 },
 "review_paths": [
  ".github/workflows/code-signing-certificate.yml"
 ],
 "body": "Currently we have no automation in place to check that our code signing certificates are not expired or close to expiry. We have previously \"relied on Release Candidates\" as a dry-run for codesigners to realise that a certificate has expired and have time to fix it. \"Noticing during RC cycle\" also might not be appropriate in the future if we release more bugfix minor/patch releases on short notice.\n\nIn place of this process we can run a weekly CI job which will check the certificate's validity and open an issue when it passes an expiry threshold.\n\nIn this draft we only check the windows cert (as I couldn't find a mac one) and we set the alert threshold to 90 days.\n\nWhen the threshold is passed, the job will open an issue in this repo (optionally tagging relevant key-holders).",
 "commits": [
  {
   "sha": "b7e371b634a0b971a9e012124431568fbcc6f194",
   "date": "2026-10-29T20:55:10Z",
   "message": "ci: Monitor Windows signing certificate expiry\n\nCheck the signing certificate on master weekly so maintainers have time\nto renew it before Windows release signing is affected. Open an issue\nwithin 90 days of expiry, including certificate details and the checked\ncommit."
  }
 ],
 "timeline": [
  {
   "t": "2026-10-27T10:16:12Z",
   "kind": "comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "text": "I've tested a run in my fork [here](https://github.com/willcl-ark/bitcoin/actions/runs/40484898362/job/122124136348) with an increased threshold of 365 days to trigger posting an issue which was correctly opened [here](https://github.com/willcl-ark/bitcoin/issues/37).",
   "id": "c:6439233861",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6439233861",
   "hash": "081c1445a3c2ab4a",
   "edited": null
  },
  {
   "t": "2026-10-27T10:43:30Z",
   "kind": "comment",
   "who": "hebasto",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nWhat's the rationale for this length period?",
   "id": "c:6439893489",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6439893489",
   "hash": "b2a91c4273c7e89d",
   "edited": null
  },
  {
   "t": "2026-10-27T10:45:14Z",
   "kind": "comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nThere is no current rationale for this, it's a placeholder for now. It depends I guess on the average lead-time to obtain updated keys.",
   "id": "c:6439926344",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6439926344",
   "hash": "dd39ea9c94ce4f71",
   "edited": null
  },
  {
   "t": "2026-10-27T13:20:50Z",
   "kind": "comment",
   "who": "achow101",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nThe lead time has been anywhere between a couple days, to about 2.5 months, depending on whether a change of CA and signing org was necessary.",
   "id": "c:6442935294",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6442935294",
   "hash": "5365ae40d146cf51",
   "edited": null
  },
  {
   "t": "2026-10-27T15:54:54Z",
   "kind": "force_push",
   "who": "willcl-ark",
   "commit": "1760a02463d2952fef48d4872da8d3f0cff583dc",
   "id": "push:1760a02463d2952fef48d4872da8d3f0cff583dc"
  },
  {
   "t": "2026-10-27T15:57:40Z",
   "kind": "comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nBumped the placeholder example threshold to 90 days.",
   "id": "c:6446779188",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6446779188",
   "hash": "f9dbd9c0ac1427f5",
   "edited": null
  },
  {
   "t": "2026-10-29T18:53:49Z",
   "kind": "review_comment",
   "who": "hebasto",
   "assoc": "MEMBER",
   "path": ".github/workflows/code-signing-certificate.yml",
   "commit": "1760a02463d2952fef48d4872da8d3f0cff583dc",
   "in_reply_to": null,
   "text": "Is anything enforcing that order?",
   "id": "rc:4416591728",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#discussion_r4416591728",
   "hash": "fbdfdb18ea22b455",
   "edited": null
  },
  {
   "t": "2026-10-29T18:59:57Z",
   "kind": "review_comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "path": ".github/workflows/code-signing-certificate.yml",
   "commit": "1760a02463d2952fef48d4872da8d3f0cff583dc",
   "in_reply_to": 4416591728,
   "text": "There is not (nice question).\n\nThe only way I know to \"check\" which is which, without hardcoding, is to check `CA:FALSE` to at least rule out that its a cert authority.\n\nI can push a change to this perhaps.",
   "id": "rc:4416655464",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#discussion_r4416655464",
   "hash": "d1da05dfbe1e62da",
   "edited": "2026-10-29T18:59:58Z"
  },
  {
   "t": "2026-10-29T19:06:41Z",
   "kind": "comment",
   "who": "hebasto",
   "assoc": "MEMBER",
   "text": "Alternatively, we could amend the release process as suggested in https://github.com/bitcoin/bitcoin/issues/36695#issuecomment-6505826743.",
   "id": "c:6505885913",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6505885913",
   "hash": "1219d3040d1b13f8",
   "edited": null
  },
  {
   "t": "2026-10-29T19:08:43Z",
   "kind": "comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nYep! No skin off my back either way; happy with either approach.",
   "id": "c:6505927336",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6505927336",
   "hash": "0dc2394034853ad5",
   "edited": null
  },
  {
   "t": "2026-10-29T20:55:29Z",
   "kind": "force_push",
   "who": "willcl-ark",
   "commit": "b7e371b634a0b971a9e012124431568fbcc6f194",
   "id": "push:b7e371b634a0b971a9e012124431568fbcc6f194"
  },
  {
   "t": "2026-10-29T20:56:18Z",
   "kind": "comment",
   "who": "fanquake",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nCan you explain what that solves? The certs are constantly used to produce (point) releases, not just major releases, so *always* need to work (particularly in the case of expedited releases, like this week).\n\nA note in an issue telling someone to manually look at the cert at an arbitrary future time is not useful if we want to know the cert works for a deployment tomorrow.",
   "id": "c:6508132613",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6508132613",
   "hash": "e36ff58568a038b0",
   "edited": null
  },
  {
   "t": "2026-10-29T20:57:22Z",
   "kind": "review_comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "path": ".github/workflows/code-signing-certificate.yml",
   "commit": "1760a02463d2952fef48d4872da8d3f0cff583dc",
   "in_reply_to": 4416591728,
   "text": "Amended slightly in b7e371b634a",
   "id": "rc:4417812290",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#discussion_r4417812290",
   "hash": "0bfea635c20fecd0",
   "edited": "2026-10-29T20:57:23Z"
  },
  {
   "t": "2026-10-29T21:15:18Z",
   "kind": "comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "text": "I think the idea was to include a new section, which is either:\n\n#### 2027-01-04 Update Windows signing cert \ud83d\udea7\n\n* Expires 2027-MM-DD\n\nor:\n\n#### 2027-01-04 Update Windows signing cert :heavy_check_mark:\n\n* Expires 2029-MM-DD, not needed\n\nMaybe a script can be added for this to make it easier to run, if needed. Trusting the CI to create such an issue (which I presume happens less than once a year) seems more brittle? But no strong opinion.",
   "id": "c:6508500612",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6508500612",
   "hash": "a4b0ab5812ad237b",
   "edited": null
  },
  {
   "t": "2026-10-30T10:36:20Z",
   "kind": "comment",
   "who": "fanquake",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nOk. I think the point of this PR is to try and move away from manual tasks that (hopefully) someone will remember to do, and more towards (automated) assurance that we can use the certs (my understanding is that the cert could also be revoked arbitrarily, along with normal expiration). Having this assurance would mean one less thing that an rc cycle needs to \"check\". Adding a note seems fine, but that seems to assume the cert is always valid?\n\nI think we should also add a similar check for macOS code-signing, given that is more prone to breakage (needs manual intervention multiple time a year to accept updated T&Cs). An automated check makes more sense in this case, because the breakage is somewhat arbitrary.",
   "id": "c:6520646183",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6520646183",
   "hash": "a6efecc6c3bf9b82",
   "edited": null
  },
  {
   "t": "2026-10-30T10:37:54Z",
   "kind": "comment",
   "who": "willcl-ark",
   "assoc": "MEMBER",
   "text": "[quoted text omitted]\n\nTo my knowledge the cert is not checked into this repo? but otherwise can trivially add the second check.",
   "id": "c:6520673273",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6520673273",
   "hash": "949757a21a5a13c4",
   "edited": null
  },
  {
   "t": "2026-10-30T11:55:45Z",
   "kind": "comment",
   "who": "maflcko",
   "assoc": "MEMBER",
   "text": "I am just a bit unsure if some random bash encoded in a string inside a yaml inside a mutable GHA VM inside some MS datacenter that requires a GHA write token to create an issue over the API is more reliable than the status quo. Again, no strong opinion, but the script should probably be stand-alone, so that it can be run locally?",
   "id": "c:6522077981",
   "url": "https://github.com/bitcoin/bitcoin/pull/36673#issuecomment-6522077981",
   "hash": "75ebd52e7e98117d",
   "edited": null
  }
 ],
 "labels_log": [
  {
   "t": "2026-10-27T10:17:38Z",
   "action": "labeled",
   "label": "Windows",
   "who": "fanquake"
  },
  {
   "t": "2026-10-29T21:43:29Z",
   "action": "labeled",
   "label": "CI failed",
   "who": "DrahtBot"
  },
  {
   "t": "2026-10-30T10:24:43Z",
   "action": "unlabeled",
   "label": "CI failed",
   "who": "DrahtBot"
  }
 ],
 "state_log": [],
 "text_chars": 4396,
 "text_tokens_estimate": 1099,
 "changed_paths": [
  ".github/workflows/code-signing-certificate.yml"
 ],
 "files": [
  {
   "path": ".github/workflows/code-signing-certificate.yml",
   "add": 76,
   "del": 0
  }
 ],
 "test_lines": 0,
 "git": {
  "head": "b7e371b634a0b971a9e012124431568fbcc6f194",
  "head_matches_backup": true,
  "base": "2b5b6fe231ff45a09d9e24411e4420d51ed45cab",
  "patch_id": "40c22e9b37361446",
  "commits": [
   {
    "sha": "b7e371b634",
    "subject": "ci: Monitor Windows signing certificate expiry",
    "files": 1,
    "add": 76,
    "del": 0
   }
  ],
  "patch_truncated": false
 },
 "patch_id": "40c22e9b37361446",
 "input_hash": "5fa352585e3ed1ce",
 "extracted_at": "2026-11-02T01:09:49+00:00"
}