[Bug] "No signature" warning on Windows even though swift.org doesn't publish Windows signatures

[shaanmajid]

• I have gone through the action README, documentation and wiki.
• I don't see my issue listed in existing issues.

Describe the bug
On Windows runners, the action emits a warning:

No signature at "https:/download.swift.org/swift-6.2.3-release/windows10/swift-6.2.3-RELEASE/swift-6.2.3-RELEASE-windows10.exe.sig"

This occurs because src/platform/windows.ts always constructs a signature URL. However, swift.org does not actually publish signature files for Windows builds.

The swift.org metadata confirms this: Windows entries in _data/builds/ lack the download_signature field, while Linux entries include it:

# Linux (_data/builds/development/ubuntu2404.yml)
- download: swift-DEVELOPMENT-SNAPSHOT-2026-01-09-a-ubuntu24.04.tar.gz
   download_signature: swift-DEVELOPMENT-SNAPSHOT-2026-01-09-a-ubuntu24.04.tar.gz.sig 

# Windows (_data/builds/development/windows10.yml)
- download: swift-DEVELOPMENT-SNAPSHOT-2026-01-09-a-windows10.exe
    # <- no download_signature field

Verified that signatures don't exist on the server:

• Linux: https://download.swift.org/.../ubuntu24.04.tar.gz.sig -> 200 OK
• Windows: https://download.swift.org/.../windows10.exe.sig -> 302 -> 404

To Reproduce
Steps to reproduce the behavior:

1. Choose runner windows-latest
2. Provide action input swift-version: "6.2"
3. Run action
4. See warning in logs: ##[warning]No signature at "https:/download.swift.org/..."

Expected behavior
No warning should be emitted since Windows signatures are not expected to exist.

Logs

• https://github.com/j178/prek/actions/runs/21263124674/job/61195588187 (search for "No signature")
• Also reproducible in other repos, e.g., https://github.com/google/flatbuffers/actions/runs/21236660714/job/61105985419

Screenshots
I wouldn't ordinarily care, but it emits a pretty loud yet inactionable warning in the action run summary

Runner (please complete the following information):

• Name: windows-latest / windows-2025
• OS: Windows
• Version: Server 2025

[shaanmajid]

Also, the READMe and wiki claim Windows uses gpg for signature verification, which is a bit misleading, as there are never any signatures to verify

[soumyamahunt]

This occurs because src/platform/windows.ts always constructs a signature URL. However, swift.org does not actually publish signature files for Windows builds.

@shaanmajid while this is true for some of the recent releases, in earlier Swift versions you will find signature files.

The swift.org metadata confirms this: Windows entries in _data/builds/ lack the download_signature field, while Linux entries include it:

Here is an example of Windows toolchain snapshot that provides signature URL.

Here is a sample valid signature.

Expected behavior
No warning should be emitted since Windows signatures are not expected to exist.

Also, the READMe and wiki claim Windows uses gpg for signature verification, which is a bit misleading, as there are never any signatures to verify

The action verifies signature for Windows toolchain that provide valid signature. If no signature is present, action generates warning to caution user the toolchain signature is not verified, and hence user should be cautious about any build artifact generated by this unverified toolchain.

[shaanmajid]

Would you be open to a PR that downgrades to info level for Windows (where signatures are often unavailable) be acceptable? Verification would still be attempted and succeed for older releases that have signatures.

My main concern is that the warning is prominent yet inactionable when shown for the affected recent releases.

[soumyamahunt]

@shaanmajid the warning is to indicate users to not use Windows toolchain generated artifacts for production usage and deployment when using this action as the action has no way to verify the toolchain. If you are using Windows toolchain installed for testing your code, then no action item is needed for this.

If you are generating exes or dlls from the toolchain and shipping those to users for usage then you shouldn't do that. Instead you can use Windows docker images published from the version when signature verification is removed. Here is a sample action that showcases docker usage using this action.

I am open to PRs making the message more explicit in communicating this in the warning. I will add this discussion to wiki FAQ as well.