Windows integration
Installs under Program Files with a Start Menu shortcut, optional Desktop shortcut, Apps & Features entry, Blackwire icon, version information, and a normal uninstaller.
Blackwire Artifact Signing Manager — Microsoft Artifact Signing from Windows
Blackwire Artifact Signing Manager v0.2.0 gives developers, small software companies, IT teams, technicians, and release teams a Windows interface for Microsoft Artifact Signing.
Install. Connect. Discover. Sign. Verify.
Coming SoonSee current-build screenshot
Installed & licensedNormal Windows installation, activation, upgrades, and uninstallation
Microsoft-backed signingMicrosoft Artifact Signing performs the actual signing operation
Automatic discoveryFind subscriptions, accounts, profiles, endpoints, and signer information
Verified resultsInspect, sign, verify, timestamp-check, and hash each artifact
Current product status
Current development build: v0.2.0.
This is being built as a normal installed and licensed Windows application, not a portable EXE or USB utility. Public checkout is not available yet.
Installation experience
Installs like a normal Windows application.
The finished product installs through the normal Blackwire setup and licensing process. You should not have to maintain a folder beside the EXE or move the app between computers by hand.
Licensed product
A Blackwire license activates the application itself. It does not grant access to Microsoft Artifact Signing or bypass Microsoft's requirements.
Upgrade in place
Updates install over the existing version so you do not have to rebuild the signing setup for every Blackwire release.
Managed application data
Settings, diagnostics, signing history, reports, backups, and other app data are kept in Blackwire-managed application-data locations instead of beside the executable.
From install to first signature
Get from installation to a signed build with less setup work.
You should not have to hunt through Azure Portal for every identifier or rebuild a long signing command every time you ship a release.
- Install BlackwireInstall Artifact Signing Manager like any other Windows application.
- Activate LicenseActivate the Blackwire license for the app.
- Prepare Microsoft toolsBlackwire checks the required Microsoft components and helps you deal with missing prerequisites.
- Sign in to MicrosoftSign in through Microsoft's supported Azure authentication flow.
- Auto ConfigureDiscover the available subscription, tenant, Artifact Signing account, certificate profile, endpoint, and expected publisher.
- Sign & VerifyAdd the release files, sign them, and verify the resulting signatures.
Microsoft component setup
Check what is installed and show what is missing.
Artifact Signing Manager checks the local signing setup and points out the pieces that still need attention.
Install Missing Components
When required Microsoft tooling is unavailable, Blackwire can assist with installing or locating components such as:
- Azure CLI
- Compatible SignTool
- Microsoft Artifact Signing Client Tools
Azure.CodeSigning.Dlib.dll- Supporting Microsoft prerequisites required by the signing client
Automatic discovery
After Microsoft authentication, Blackwire can discover and organize available customer configuration:
- Azure subscription and tenant
- Artifact Signing account
- Certificate profile
- Signing endpoint or region
- Expected publisher/signer where available
- Advanced manual selections or tool-path overrides for unusual environments
Security and privacy
Your Azure sign-in stays with Microsoft.
The app works with Microsoft's supported authentication and signing services without asking you to hand Blackwire an Azure password or private signing key.
Non-secret configuration can be stored locally
The app can remember the non-secret settings needed to find and use your selected Artifact Signing environment.
- Azure Tenant ID and Subscription ID
- Subscription name
- Artifact Signing account and certificate profile
- Artifact Signing endpoint
- Expected publisher/signer
- Timestamp URL
- Tool detection information and user-selected overrides
- Application preferences, diagnostics, and licensing state where required
Blackwire does not store signing secrets
Microsoft handles the account authentication, and Microsoft Artifact Signing performs the signing operation on Microsoft's infrastructure.
- No Azure account password stored by Artifact Signing Manager
- No private signing key stored or imported into Blackwire
- No client secret stored by the application
- No manually captured Azure access token stored by Blackwire
- No exported private code-signing certificate required by Blackwire
In short: the app can remember normal configuration. It does not store Azure passwords, private signing keys, client secrets, or manually captured access tokens.
Customer configuration
Your Artifact Signing setup stays separate from the Blackwire executable.
Blackwire's own Azure subscription, tenant, Artifact Signing account, certificate profile, and internal signing settings are not built into customer releases.
Customer-specific setup
Each installation keeps the configuration for that customer's own Microsoft Artifact Signing environment.
Application-data storage
Saved configuration lives in Blackwire-managed application-data locations, not in a portable Config folder beside the EXE.
Use Blackwire controls
Buttons such as Open Diagnostics, Open Reports, Open Backups, Export History, and Open Configuration Location give you direct access without having to browse through application folders.
Batch signing
Sign a release set without rebuilding commands for every file.
Add multiple supported Windows files to one queue. Each file is inspected, signed, verified, and reported separately.
Supported release formats
- EXE
- DLL
- MSI
- MSIX
- APPX
- CAB
- MSIXBUNDLE
- APPXBUNDLE
The app focuses on release formats covered by the tested Microsoft Artifact Signing workflow; it does not claim that every possible file type is supported.
Per-file visibility
- File name, type, and size
- Current signature and publisher
- Signing status
- Verification result
- Final SHA-256
- Existing-signature protection
- Optional backup copy before signing
- Clear failure handling without silently treating the whole queue as successful
Signing and verification
A successful command is not the same as a verified signature.
After Microsoft signs the file, Artifact Signing Manager checks the result instead of stopping at the command exit code.
Signature inspection
Inspect the existing Authenticode state before signing and protect already-signed or third-party artifacts from silent replacement.
Microsoft signing workflow
Submit eligible artifacts through Microsoft's supported signing client and Artifact Signing infrastructure using SHA-256 signing and trusted timestamping.
Independent verification
Run SignTool and Windows Authenticode checks, confirm signature validity, verify the expected publisher, and confirm trusted timestamp information.
Final release evidence
Calculate SHA-256 only after signing is complete so hashes represent the final signed artifacts rather than pre-signing files.
Diagnostics
Keep the raw technical output available without putting it in your way.
Diagnostics are there when Microsoft tooling, authentication, prerequisites, signing, or verification need a closer look.
Diagnostic information can include
- Azure CLI checks
- Microsoft Artifact Signing Client output
- SignTool output
- Tool detection results
- Installation and prerequisite logs
- Signing errors
- Verification results
Blackwire controls
The app lets you view, copy, save, export, and clear diagnostic information. Raw output stays out of the main dashboard unless it needs your attention.
- Open Diagnostics
- Copy or save relevant output
- Export diagnostic evidence
- Clear diagnostics when appropriate
Licensed Blackwire product
A Blackwire license controls the app, not Microsoft's service.
Artifact Signing Manager uses normal Blackwire activation. That license does not create a Microsoft Artifact Signing account, grant Azure permissions, or bypass Microsoft requirements.
What the Blackwire license provides
- Access to the installed Blackwire Artifact Signing Manager application
- Normal product activation and licensed-use enforcement
- Blackwire product updates and revisions as applicable to the product
What it does not provide
- A Microsoft Artifact Signing account
- A Microsoft signing certificate or certificate profile
- A bypass of Microsoft's identity verification
- A bypass of Azure permissions
- Access to an Artifact Signing account the customer does not own or have permission to use
Who it is for
For people who sign Windows releases regularly.
Independent developers
Sign Windows applications and releases using Microsoft's identity-backed service without reconstructing SignTool commands for every build.
Small software companies
Standardize a repeatable signing workflow around the company's own Microsoft Artifact Signing environment.
IT professionals & technicians
Sign internal utilities, deployment packages, support tools, installers, and other Windows binaries that require a verifiable release process.
Release teams
Process multi-file release sets with per-artifact inspection, signing, verification, timestamp checks, backups, diagnostics, and final hashes.
What it does not do
Blackwire simplifies the workflow. It does not replace Microsoft's security model.
- Does not provide its own certificate authority
- Does not replace Microsoft Artifact Signing
- Does not bypass Microsoft's identity-verification requirements
- Does not automatically create an Artifact Signing account for an ineligible customer
- Does not bypass Azure permissions
- Does not give users access to accounts they are not authorized to use
- Does not store Azure passwords, private signing keys, or client secrets
- Does not require an exported private code-signing certificate
- Does not bypass Windows signature validation
- Does not fake successful signing
- Does not silently replace an existing third-party signature
- Does not treat a SignTool exit code alone as proof that an artifact is successfully signed
Frequently asked questions
Common questions before release.
Is Blackwire Artifact Signing Manager installed or portable?
Blackwire Artifact Signing Manager is a normal installed Windows application. It uses a Blackwire installer, integrates with Windows Apps & Features, supports normal upgrades and uninstallation, and uses product licensing and activation.
Can I copy the EXE to another computer and use it there?
The product is not designed as a portable EXE. Install and activate Blackwire Artifact Signing Manager normally on the Windows computer where it will be used, subject to the product's licensing terms.
Does my Azure configuration get built into the Blackwire application?
No. Customer-specific Azure and Artifact Signing configuration is maintained separately by the installed application. Blackwire's own internal Artifact Signing configuration is not embedded into customer releases.
What information does Blackwire store locally?
The application can store normal configuration and operational information such as the selected subscription, tenant ID, Artifact Signing account, certificate profile, expected publisher, endpoint, settings, diagnostics, reports, signing history, and licensing state. Blackwire Artifact Signing Manager does not store the customer's Azure password, private signing key, client secret, or manually captured Azure access tokens.
Does Blackwire Artifact Signing Manager provide me with a signing certificate?
No. Microsoft Artifact Signing provides the identity-backed signing service. Blackwire manages and simplifies the workflow around the customer's eligible Microsoft environment.
Do I still need Microsoft Artifact Signing?
Yes. The customer still needs an eligible Microsoft Artifact Signing environment and the necessary permissions. Blackwire does not provide or bypass those Microsoft requirements.
Can I sign multiple files at once?
Yes. The application supports batch signing for supported Windows release artifacts while tracking and verifying each file independently.
Does Blackwire verify the file after signing?
Yes. The workflow is designed to verify Authenticode status, the expected publisher, and trusted timestamp information before treating an artifact as signed and verified.
Release status
Blackwire Artifact Signing Manager v0.2.0 is Coming Soon.
This licensed Windows product is still in development. Pricing, license limits, and checkout terms have not been published yet, and customers will still need an eligible Microsoft Artifact Signing environment.