Batch Signing Guide

npm install -g @qwickcert/cli
qwick auth login
qwick sign "dist/**/*.exe" --verify

This signs every .exe file in dist/ recursively and verifies each signature afterward.

The CLI uses fast-glob for pattern matching, supporting recursive globs, brace expansion, and negation.

Recursive globs

qwick sign "dist/**/*.exe"        # all .exe in dist/ and subdirectories
qwick sign "build/**/*.dll"       # all .dll in build/ tree

Brace expansion

qwick sign "dist/**/*.{exe,dll,msi}"   # multiple extensions

Exclude patterns

Use excludePatterns in your .qwickrc.json to skip files by pattern:

{
  "files": ["dist/**/*.exe"],
  "excludePatterns": ["*test*", "*debug*"]
}

Store all signing settings in a config file so your team can run qwick sign with no arguments.

qwick config init

{
  "project": "my-app",
  "organization": "acme-corp",
  "files": ["dist/**/*.exe", "dist/**/*.dll"],
  "excludePatterns": ["*test*"],
  "timestampUrl": "http://timestamp.acs.microsoft.com",
  "digestAlgorithm": "sha256",
  "parallel": 4,
  "verify": true,
  "outputFormat": "text"
}

See the CLI Reference for the full schema and precedence order.

Run multiple SignTool processes concurrently to speed up large batch jobs. All workers share the same credential session.

qwick sign "dist/**/*.exe" --parallel 4

The --verify flag runs signtool verify /pa on every signed file. If any verification fails, the CLI exits with a non-zero code.

qwick sign "dist/**/*.exe" --verify

# Output:
# ✓ Signed 12 files in 18.4s — all signatures verified

You can also enable this permanently in .qwickrc.json:

{ "verify": true }

If signing is interrupted (crash, network error, Ctrl+C), the CLI saves progress to .qwick-signing-state.json. Resume where you left off:

# First attempt — interrupted after 5/20 files
qwick sign "dist/**/*.exe" --progress

# Resume — skips the 5 already-signed files
qwick sign "dist/**/*.exe" --resume

Use --output json for machine-readable output in CI pipelines. The exit code is the canonical success/failure signal.

qwick sign "dist/**/*.exe" --output json --verify

The JSON output includes per-file results, timing, the operation ID, and verification status.

GitHub Actions example

- name: Sign build output
  run: |
    npx @qwickcert/cli sign "dist/**/*.{exe,dll}" \
      --parallel 4 \
      --verify \
      --output json > signing-results.json
  env:
    QWICK_API_KEY: ${{ secrets.QWICK_API_KEY }}
    QWICK_PROJECT: my-app