A patch release whose only substantive change is that every executable we publish is signed, including the three Velopack generates itself.
What was wrong
On v3.6.0 and v3.7.0 the app payload was signed but the portable launcher stub, Update.exe and Setup.exe were not — so the file a user double-clicks in the portable zip was an unsigned launcher rather than the signed app, which is exactly what an "unknown publisher" policy blocks.
Those three are created after packing, and they cannot be signed afterwards: re-signing a file inside a .nupkg changes that package's bytes and invalidates the SHA256 and Size that releases.<channel>.json records and that delta packages patch against. So vpk pack now signs them during packing, and because the packer does not check whether its signing hook did anything, a release-time guard refuses to publish an executable with no certificate table — including executables inside the published zips and packages.
Why this release exists, and what is NOT in it
This is cut from the v3.7.0 tag, not from the development branch. It carries the signing change and nothing else: no application code, no database schema change, and none of the unreleased work queued for the next feature release. Upgrading from 3.7.0 changes no behaviour and migrates no data.
It is published as a pre-release because its purpose is to verify the signing path end to end — no release has exercised it since the fix landed. 3.7.0 remains the current release.
Also included
The v3.7.0 migration-ladder test fixture, which the upgrade-path gate requires for the most recently shipped release and which did not previously exist.