Switch binary signing to Azure

.github/workflows/dev-release.yml

@@ -30,6 +30,9 @@ jobs:
       version: dev
 
   sign:
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/sign-binary.yml
     needs:
       - package
@@ -51,11 +54,11 @@ jobs:
     secrets:
       apple-notary-user: ${{ secrets.APPLE_NOTARY_USER }}
       apple-notary-password: ${{ secrets.APPLE_NOTARY_PASSWORD }}
-      certificate-data: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_DATA || secrets.KEYLOCKER_CLIENT_CERT }}
-      certificate-password: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_PASSWORD || secrets.KEYLOCKER_CLIENT_CERT_PASSWORD }}
-      keylocker-api-key: ${{ secrets.KEYLOCKER_API_KEY }}
-      keylocker-cert-sha1-hash: ${{ secrets.KEYLOCKER_CERT_SHA1_HASH }}
-      keylocker-keypair-alias: ${{ secrets.KEYLOCKER_KEYPAIR_ALIAS }}
+      azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+      azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+      certificate-data: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_DATA || '' }}
+      certificate-password: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_PASSWORD || '' }}
 
   build-release-binary-alias:
     uses: ./.github/workflows/release-rename-binary.yml

.github/workflows/release.yml

@@ -6,7 +6,6 @@ on:
       - created
 
 permissions:
-  id-token: write
   contents: write
 
 jobs:
@@ -32,6 +31,9 @@ jobs:
       version: ${{ github.event.release.tag_name }}
 
   sign:
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/sign-binary.yml
     needs:
       - package
@@ -53,11 +55,11 @@ jobs:
     secrets:
       apple-notary-user: ${{ secrets.APPLE_NOTARY_USER }}
       apple-notary-password: ${{ secrets.APPLE_NOTARY_PASSWORD }}
-      certificate-data: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_DATA || secrets.KEYLOCKER_CLIENT_CERT }}
-      certificate-password: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_PASSWORD || secrets.KEYLOCKER_CLIENT_CERT_PASSWORD }}
-      keylocker-api-key: ${{ secrets.KEYLOCKER_API_KEY }}
-      keylocker-cert-sha1-hash: ${{ secrets.KEYLOCKER_CERT_SHA1_HASH }}
-      keylocker-keypair-alias: ${{ secrets.KEYLOCKER_KEYPAIR_ALIAS }}
+      azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+      azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+      certificate-data: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_DATA || '' }}
+      certificate-password: ${{ contains(matrix.file, 'macos') && secrets.APPLE_CERT_PASSWORD || '' }}
 
   build-release-binary-alias:
     uses: ./.github/workflows/release-rename-binary.yml

.github/workflows/sign-binary.yml

@@ -25,28 +25,31 @@ on:
     secrets:
       certificate-data:
         description: "A `base64` encoded string of your `p12` or `pfx` cert contents."
-        required: true
+        required: false
       certificate-password:
         description: "The password to unlock the certificate-data"
-        required: true
+        required: false
       apple-notary-password:
         description: "The Apple Developer account password to use in notarization"
         required: false
       apple-notary-user:
         description: "The Apple Developer account email to use in notarization"
         required: false
-      keylocker-api-key:
-        description: "The API key to use for KeyLocker"
+      azure-client-id:
+        description: "The Azure application client ID to use for Azure Artifact Signing"
         required: false
-      keylocker-cert-sha1-hash:
-        description: "The SHA1 hash of the certificate to use for KeyLocker"
+      azure-subscription-id:
+        description: "The Azure subscription ID to use for Azure Artifact Signing"
         required: false
-      keylocker-keypair-alias:
-        description: "The alias of the keypair to use for KeyLocker"
+      azure-tenant-id:
+        description: "The Azure tenant ID to use for Azure Artifact Signing"
         required: false
 
 jobs:
   codesign-binary:
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ${{
       (contains(inputs.os, 'linux') || contains(inputs.file, 'linux')) && 'ubuntu-24.04' ||
       (contains(inputs.os, 'macos') || contains(inputs.file, 'macos')) && 'macos-15' ||
@@ -75,15 +78,17 @@ jobs:
           apple-notary-password: ${{ secrets.apple-notary-password }}
           apple-product-id: dev.lando.cli
           apple-team-id: 466VYKC9T5
+          azure-client-id: ${{ secrets.azure-client-id }}
+          azure-signing-account-name: lando
+          azure-signing-endpoint: https://eus.codesigning.azure.net/
+          azure-subscription-id: ${{ secrets.azure-subscription-id }}
+          azure-tenant-id: ${{ secrets.azure-tenant-id }}
           certificate-data: ${{ secrets.certificate-data }}
-          certificate-id: 466VYKC9T5
+          certificate-id: ${{ runner.os == 'Windows' && 'lando' || '466VYKC9T5' }}
           certificate-password: ${{ secrets.certificate-password }}
           file: ${{ steps.download-artifacts.outputs.download-path }}/${{ inputs.file }}${{ runner.os == 'Windows' && !endsWith(inputs.file, '.exe') && '.exe' || '' }}
-          keylocker-api-key: ${{ secrets.keylocker-api-key }}
-          keylocker-cert-sha1-hash: ${{ secrets.keylocker-cert-sha1-hash }}
-          keylocker-host: https://clientauth.one.digicert.com
-          keylocker-keypair-alias: ${{ secrets.keylocker-keypair-alias }}
           options: ${{ runner.os == 'macOS' && '--options runtime --entitlements "$GITHUB_WORKSPACE/entitlements.xml"' || '' }}
+          signtool: ${{ runner.os == 'Windows' && 'azure' || 'auto' }}
       - name: Upload signed binaries
         uses: actions/upload-artifact@v7
         with:

docs/.vitepress/config.mjs

@@ -95,13 +95,13 @@ export default defineConfig({
           email: 'mike@lando.dev',
           title: 'Co-founder',
           org: 'lando.dev',
-          orgLink: 'https://lando.dev',
+          orgLink: 'https://www.lando.dev',
           desc: 'SLAVE4U',
           links: [
             {icon: 'github', link: 'https://github.com/pirog'},
             {icon: 'x', link: 'https://x.com/pirogcommamike'},
           ],
-          sponsor: 'https://lando.dev/sponsor',
+          sponsor: 'https://www.lando.dev/sponsor',
           maintainer: true,
           mergeOnly: true,
         },
@@ -111,13 +111,13 @@ export default defineConfig({
           email: 'alec+git@thinktandem.io',
           title: 'Co-founder',
           org: 'lando.dev',
-          orgLink: 'https://lando.dev',
+          orgLink: 'https://www.lando.dev',
           desc: 'A chill dude',
           links: [
             {icon: 'github', link: 'https://github.com/reynoldsalec'},
             {icon: 'x', link: 'https://x.com/reynoldsalec'},
           ],
-          sponsor: 'https://lando.dev/sponsor',
+          sponsor: 'https://www.lando.dev/sponsor',
           maintainer: true,
           mergeOnly: true,
         },

docs/contrib/evangelist.md

@@ -12,7 +12,7 @@ Because Lando is a free and open source project without :unicorn: money, we rely
 
 While you should _do you_ and evangelize in the way that best suits you, here are some things our more successful advocates do:
 
-* Present, talk or train about Lando or Lando-adjacent materials at conference, camps, meetups, etc and to post those events at <https://lando.dev/events>.
+* Present, talk or train about Lando or Lando-adjacent materials at conference, camps, meetups, etc and to post those events at <https://www.lando.dev/events>.
 * Retweet Lando content, tweet directly at [@devwithlando](https://twitter.com/devwithlando) or engage in local dev or DevOps related Twitter threads.
 * Troll local development blog content and mention Lando in the comments, if applicable.
 * Get friends, colleagues, spouses, partners, pets, grandparents, former roommates, etc. to follow us [@devwithlando](https://twitter.com/devwithlando) and [star our project on GitHub](https://github.com/lando/lando).
@@ -90,7 +90,7 @@ If you are interested in helping, make sure you [join our Slack org](https://www
 
 Some talking points you can use in your presentations or next dinner date are shown below:
 
-These are intended to try and convince a more-technical audience to adopt Lando. If you are interested in more business focused talking points, particularly if you are trying to convince an org to sponsor Lando, then check [these out](https://lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html) instead.
+These are intended to try and convince a more-technical audience to adopt Lando. If you are interested in more business focused talking points, particularly if you are trying to convince an org to sponsor Lando, then check [these out](https://www.lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html) instead.
 
 ### High Level
 

docs/contrib/index.md

@@ -5,7 +5,7 @@ description: Learn how to contribute to Lando.
 # Getting Involved
 
 ::: center
-![Lando Alliance](https://lando.dev/images/lando-alliance.png)
+![Lando Alliance](https://www.lando.dev/images/lando-alliance.png)
 :::
 
 If you are interested in helping out with the Lando project, then you've come to the _**right place!**_ We are looking for people to help out in any of the capacities as follows:

docs/contrib/sponsoring.md

@@ -47,11 +47,11 @@ By sponsoring Lando with your hard earned American dollars, the Lando team can d
 
 If you'd like to read more about why you should sponsor Lando, we encourage you to check out the posts as follows:
 
-* [Why you should sponsor Lando](https://lando.dev/blog/2020/02/07/why-you-should-sponsor-lando.html)
-* [Why your agency or org should sponsor Lando](https://lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html)
-* [Why your PaaS or dev tool should sponsor Lando](https://lando.dev/blog/2020/02/08/why-your-pass-should-sponsor-lando.html)
+* [Why you should sponsor Lando](https://www.lando.dev/blog/2020/02/07/why-you-should-sponsor-lando.html)
+* [Why your agency or org should sponsor Lando](https://www.lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html)
+* [Why your PaaS or dev tool should sponsor Lando](https://www.lando.dev/blog/2020/02/08/why-your-pass-should-sponsor-lando.html)
 
-If you are interested in sponsoring at one of our higher tiers, then definitely [contact us](https://lando.dev/contact/) so we can figure out the terms of your sponsorship.
+If you are interested in sponsoring at one of our higher tiers, then definitely [contact us](https://www.lando.dev/contact/) so we can figure out the terms of your sponsorship.
 
 ## Helping others sponsors
 
@@ -73,9 +73,9 @@ If you and your team are saving development time using Lando, your organization
 
 Asking your boss to sponsor Lando might seem tough. Why should they pay for something they're already getting for free? There are _many_ reasons and we've prepared them all in the easily distributable blog content below:
 
-* [Why you should sponsor Lando](https://lando.dev/blog/2020/02/07/why-you-should-sponsor-lando.html)
-* [Why your agency or org should sponsor Lando](https://lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html)
-* [Why your PaaS or dev tool should sponsor Lando](https://lando.dev/blog/2020/02/08/why-your-pass-should-sponsor-lando.html)
+* [Why you should sponsor Lando](https://www.lando.dev/blog/2020/02/07/why-you-should-sponsor-lando.html)
+* [Why your agency or org should sponsor Lando](https://www.lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html)
+* [Why your PaaS or dev tool should sponsor Lando](https://www.lando.dev/blog/2020/02/08/why-your-pass-should-sponsor-lando.html)
 
 ### They're Ready to Sponsor. Now What?
 
@@ -89,7 +89,7 @@ Some answers to some of our most frequent questions about sponsorship are shown
 
 ### When will I show up on the website, Twitter, etc?
 
-We usually batch update our [list of sponsors](https://lando.dev/sponsor/) and Twitter queue _at least_ once a week so you should expect to see yourself or your org on the website within a week. Twitter can be a different story and depends on the queue. If there are a lot of sponsors in front of you, you might have to wait up to a month to get your shoutout.
+We usually batch update our [list of sponsors](https://www.lando.dev/sponsor/) and Twitter queue _at least_ once a week so you should expect to see yourself or your org on the website within a week. Twitter can be a different story and depends on the queue. If there are a lot of sponsors in front of you, you might have to wait up to a month to get your shoutout.
 
 An exception to the above rule is if you have sponsored at one of our higher tiers and we've provided custom marketing benefits. However, in this case, you will be directly in touch with one of our team members to coordinate the rollout.
 
@@ -103,7 +103,7 @@ Due to the time and administrative overhead, we usually send swag out once a qua
 
 Yes!
 
-Our highest two tiers are fairly customizable based around your needs. If you would like to put together custom sponsorship terms, then [contact us](https://lando.dev/contact/) and let us know what you are looking for. Our team will get in touch with you shortly and try to figure out something that works for all.
+Our highest two tiers are fairly customizable based around your needs. If you would like to put together custom sponsorship terms, then [contact us](https://www.lando.dev/contact/) and let us know what you are looking for. Our team will get in touch with you shortly and try to figure out something that works for all.
 
 ### How do I cancel a sponsorship?
 
@@ -115,4 +115,4 @@ We rely on third party sponsorship platforms to manage your sponsorship so you w
 
 ### How can I convince my boss or org to sponsor?
 
-We have some ideas for that [over here](https://lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html)!
+We have some ideas for that [over here](https://www.lando.dev/blog/2020/02/08/why-your-agency-should-sponsor-lando.html)!

docs/data.md

@@ -14,7 +14,7 @@ prev:
 
 # Privacy Policy for Humans
 
-Because most sane people are not lawyers we've included this more-human-accessible explanation of Lando's [Privacy Policy](https://lando.dev/privacy). Note that this *_is not_* the actual Privacy Policy.
+Because most sane people are not lawyers we've included this more-human-accessible explanation of Lando's [Privacy Policy](https://www.lando.dev/privacy). Note that this *_is not_* the actual Privacy Policy.
 
 ## tl;dr
 

docs/guides/accessibility.md

@@ -33,6 +33,6 @@ Lando is committed to ensuring digital accessibility for people with disabilitie
 We welcome your feedback on the accessibility of Lando. Please let us know if you encounter accessibility barriers:
 
 - **Contact Information**: vpat@lando.dev
-- **Support**: Support for Lando as a free, open-source tool is provided by the Lando community on a volunteer basis via [documented support channels.](https://lando.dev/support)
+- **Support**: Support for Lando as a free, open-source tool is provided by the Lando community on a volunteer basis via [documented support channels.](https://www.lando.dev/support)
 
-Please [contact us](https://lando.dev/contact) if you're interested in paid enterprise support, including accessibility support.
+Please [contact us](https://www.lando.dev/contact) if you're interested in paid enterprise support, including accessibility support.

docs/guides/how-do-i-use-orbstack.md

@@ -17,7 +17,7 @@ updated:
 
 > Switching from Docker Desktop is 100% seamless: just open OrbStack and get started.
 
-Official support for swapping Docker providers will be available in [Lando 4](https://lando.dev/blog/2023/01/23/roadmap-of-2023.html). In the meantime, you can use [Orbstack](https://orbstack.dev/) as a drop-in replacement.
+Official support for swapping Docker providers will be available in [Lando 4](https://www.lando.dev/blog/2023/01/23/roadmap-of-2023.html). In the meantime, you can use [Orbstack](https://orbstack.dev/) as a drop-in replacement.
 
 After installing Lando, follow these steps:
 

docs/index.md

@@ -40,7 +40,7 @@ footer: Copyright ©2025 Lando Alliance
         </a>
         <VPIconChevronRight v-if="showVersionSelector" class="version-dropdown-icon" @click="toggleVersion"/>
       </div>
-      <a class="VPButton medium alt sponsor" href="https://lando.dev/sponsor" target="_blank" rel="noreferrer">
+      <a class="VPButton medium alt sponsor" href="https://www.lando.dev/sponsor" target="_blank" rel="noreferrer">
         <svg class="vibe" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill="red" d="M20.84 4.61a5.5 5.5 0 0 0-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 0 0-7.78 7.78l1.06 1.06L12 21.23l7.78-7.78 1.06-1.06a5.5 5.5 0 0 0 0-7.78z"></path></svg>
         Sponsor
       </a>
@@ -53,7 +53,7 @@ footer: Copyright ©2025 Lando Alliance
 <div class="home-other-stuff">
   <VPSponsors tier="special thanks to" mode="normal" :data="all" size="medium"/>
   <div class="et-tu">
-    <a href="https://lando.dev/sponsor" target="_blank" rel="noopener">
+    <a href="https://www.lando.dev/sponsor" target="_blank" rel="noopener">
       {{ `and ${heraldcompute} others, including you?` }}
     </a>
   </div>
@@ -96,19 +96,19 @@ footer: Copyright ©2025 Lando Alliance
         <div class="menu-primary">
           <ul>
             <li>
-              <a href="https://lando.dev" target="_blank" rel="noopener noreferrer">Website</a>
+              <a href="https://www.lando.dev" target="_blank" rel="noopener noreferrer">Website</a>
             </li>
             <li>
-              <a href="https://lando.dev/blog/" target="_blank" rel="noopener noreferrer">Blog</a>
+              <a href="https://www.lando.dev/blog/" target="_blank" rel="noopener noreferrer">Blog</a>
             </li>
             <li>
-              <a href="https://lando.dev/events/" target="_blank" rel="noopener noreferrer">Events</a>
+              <a href="https://www.lando.dev/events/" target="_blank" rel="noopener noreferrer">Events</a>
             </li>
             <li>
-              <a href="https://lando.dev/support/" target="_blank" rel="noopener noreferrer">Support</a>
+              <a href="https://www.lando.dev/support/" target="_blank" rel="noopener noreferrer">Support</a>
             </li>
             <li>
-              <a href="https://lando.dev/contact/" target="_blank" rel="noopener noreferrer">Contact Us</a>
+              <a href="https://www.lando.dev/contact/" target="_blank" rel="noopener noreferrer">Contact Us</a>
             </li>
           </ul>
         </div>

netlify.toml

@@ -12,6 +12,9 @@
   [context.deploy-preview.plugins.inputs]
     todoPatterns = [
       "https://support.patreon.com",
+      "https://support.mozilla.org",
+      # Upstream/shared docs content still emits bare-domain redirects.
+      "https://lando.dev",
       "https://docs.google.com/document",
       "https://docs.google.com/forms",
       "https://github.com",