文档说明 Windows 无免费可信代码签名

补充 Authenticode 需付费、Let’s Encrypt 不能签 exe，以及当前未签名发布的原因。

Author: dengmengmian

README.md

@@ -38,7 +38,7 @@
 | Debian / Ubuntu | [AgentGate_1.4.12_amd64.deb](https://github.com/dengmengmian/agentgate-ai/releases/download/v1.4.12/AgentGate_1.4.12_amd64.deb) |
 | Other Linux distros | [AgentGate_1.4.12_amd64.AppImage](https://github.com/dengmengmian/agentgate-ai/releases/download/v1.4.12/AgentGate_1.4.12_amd64.AppImage) |
 
-**Windows install note:** Edge/Chrome may say the file is “usually not downloaded,” and SmartScreen may show **Windows protected your PC**. That is expected for an open-source installer that is not Microsoft-signed — not a virus report. Download only from [GitHub Releases](https://github.com/dengmengmian/agentgate-ai/releases). In the browser choose **Keep** / **Keep anyway**, then when SmartScreen appears click **More info** → **Run anyway**.
+**Windows install note:** Edge/Chrome may say the file is “usually not downloaded,” and SmartScreen may show **Windows protected your PC**. That is expected: the installer is not Authenticode-signed. There is no free, widely trusted Windows code-signing certificate (Let’s Encrypt only covers HTTPS, not `.exe`), so open-source builds often ship unsigned — this is **not** a virus report. Download only from [GitHub Releases](https://github.com/dengmengmian/agentgate-ai/releases). In the browser choose **Keep** / **Keep anyway**, then when SmartScreen appears click **More info** → **Run anyway**.
 
 On macOS you can also install with Homebrew:
 

README_ZH.md

@@ -38,7 +38,7 @@
 | Debian / Ubuntu | [AgentGate_1.4.12_amd64.deb](https://github.com/dengmengmian/agentgate-ai/releases/download/v1.4.12/AgentGate_1.4.12_amd64.deb) |
 | 其他 Linux 发行版 | [AgentGate_1.4.12_amd64.AppImage](https://github.com/dengmengmian/agentgate-ai/releases/download/v1.4.12/AgentGate_1.4.12_amd64.AppImage) |
 
-**Windows 安装提示：** Edge/Chrome 可能提示「通常不会下载」，SmartScreen 可能提示「Windows 已保护你的电脑」。这是未做微软代码签名、下载量尚少的开源安装包常见拦截，**不是病毒报错**。请只从 [GitHub Releases](https://github.com/dengmengmian/agentgate-ai/releases) 下载；浏览器里选 **保留 / 仍要保留**，运行时点 **更多信息** → **仍要运行**。
+**Windows 安装提示：** Edge/Chrome 可能提示「通常不会下载」，SmartScreen 可能提示「Windows 已保护你的电脑」。这是预期行为：安装包目前**未做 Authenticode 代码签名**。业界没有像 Let’s Encrypt 那样「免费且被 Windows 默认信任」的代码签名证书（免费证书只管 HTTPS 网站，不能签 `.exe`），开源项目常见先发未签名包——**不是病毒报错**。请只从 [GitHub Releases](https://github.com/dengmengmian/agentgate-ai/releases) 下载；浏览器里选 **保留 / 仍要保留**，运行时点 **更多信息** → **仍要运行**。
 
 macOS 也可以用 Homebrew 安装：
 

docs/full-reference-zh.md

@@ -38,7 +38,7 @@ English: [Main Reference](./full-reference.md)
 
 > 无界面 CLI（`agentgate-serve`）的 tarball 包和所有历史版本：[Releases](https://github.com/dengmengmian/agentgate-ai/releases)
 
-**Windows 安装提示：** Edge/Chrome 可能提示「通常不会下载」，SmartScreen 可能提示「Windows 已保护你的电脑」。这是未做微软代码签名的开源安装包常见拦截，不是病毒结论。请只从官方 Releases 下载；浏览器选 **保留**，运行时点 **更多信息** → **仍要运行**。
+**Windows 安装提示：** Edge/Chrome 可能提示「通常不会下载」，SmartScreen 可能提示「Windows 已保护你的电脑」。这是预期行为：安装包未做 Authenticode 代码签名。没有「免费且被 Windows 默认信任」的代码签名证书（Let’s Encrypt 只签网站 HTTPS，不能签 `.exe`），开源项目常先发未签名包——不是病毒结论。请只从官方 Releases 下载；浏览器选 **保留**，运行时点 **更多信息** → **仍要运行**。
 
 ## 为什么用 AgentGate
 
@@ -306,11 +306,13 @@ xattr -d com.apple.quarantine /Applications/AgentGate.app
 <details>
 <summary><b>Windows SmartScreen / 浏览器「通常不会下载」?</b>（点击展开）</summary>
 
-安装包未做微软代码签名，首次下载和运行常会遇到两层提示：
+安装包未做 Authenticode 代码签名，首次下载和运行常会遇到两层提示：
 
 1. **浏览器（Edge/Chrome）：**「通常不会下载」→ 点 ⋯ → **保留** / **仍要保留**。
 2. **SmartScreen：**「Windows 已保护你的电脑」→ **更多信息** → **仍要运行**。
 
+**为什么未签名？** 商用 Windows 代码签名证书需要付费；不存在像 Let’s Encrypt 那样免费且被系统默认信任的代码签名（Let’s Encrypt 只覆盖网站 HTTPS，不能签安装包）。AgentGate 目前选择未签名发布，并在文档中说明如何通过上述提示。
+
 请只从 [官方 GitHub Releases](https://github.com/dengmengmian/agentgate-ai/releases) 下载。这是签名/信誉拦截，不是已确认的病毒结论。同一台机器通常只需确认一次。
 
 </details>

docs/full-reference.md

@@ -36,7 +36,7 @@
 
 > Headless CLI (`agentgate-serve`) tarballs and all versions: [Releases](https://github.com/dengmengmian/agentgate-ai/releases)
 
-**Windows install note:** Edge/Chrome may warn that the file is “usually not downloaded,” and SmartScreen may show **Windows protected your PC**. Expected for an open-source, non–Microsoft-signed installer — not a malware verdict. Download only from official Releases; **Keep** the file in the browser, then **More info** → **Run anyway** on SmartScreen.
+**Windows install note:** Edge/Chrome may warn that the file is “usually not downloaded,” and SmartScreen may show **Windows protected your PC**. Expected: the installer is not Authenticode-signed. There is no free, widely trusted Windows code-signing certificate (Let’s Encrypt is for HTTPS only, not `.exe`), so many open-source projects ship unsigned — not a malware verdict. Download only from official Releases; **Keep** the file in the browser, then **More info** → **Run anyway** on SmartScreen.
 
 ## Why AgentGate
 
@@ -304,11 +304,13 @@ xattr -d com.apple.quarantine /Applications/AgentGate.app
 <details>
 <summary><b>Windows SmartScreen / browser “won’t download”?</b> (click to expand)</summary>
 
-The NSIS installer is not Microsoft code-signed, so first-time download and launch often trigger two warnings:
+The NSIS installer is not Authenticode-signed, so first-time download and launch often trigger two warnings:
 
 1. **Browser (Edge/Chrome):** “Usually won’t download” / “Make sure you trust …” → open the ⋯ menu → **Keep** / **Keep anyway**.
 2. **SmartScreen:** “Windows protected your PC” → **More info** → **Run anyway**.
 
+**Why unsigned?** Commercial Windows code-signing certificates cost money. There is no free equivalent that Windows trusts by default (Let’s Encrypt covers HTTPS sites, not desktop installers). AgentGate ships unsigned for now and documents this path instead.
+
 Download only from [official GitHub Releases](https://github.com/dengmengmian/agentgate-ai/releases). These prompts are reputation/signature checks, not a confirmed malware scan result. You typically only need to confirm once per machine.
 
 </details>