In a couple of days Windows will no longer trust sha-1 code-signing. It happened in the past that Microsoft announced changes to AuthentiCode, and then did not follow though, but it looks like this one is going to happen.
First of all, the loss of trust will not happen for all executables with a sha-1 signature. It will only happen with executables with a “Mark of the Web” attribute and without a timestamp or a timestamp after 1/1/2016.
A “Mark of the Web” attribute means that the executable is flagged as downloaded from an untrusted source (the Internet), like this one:
This is done with an Alternate Data Stream (ADS) named Zone.Identifier and with content like this:
[ZoneTransfer] ZoneId=3
If you develop executables that will be downloaded and you sign with a sha-1 certificate, check that you also include a timestamp. As I explained in my blogpost, you can add a missing timestamp after signing. You don’t even need a code signing certificate to add a timestamp.
Didier Stevens 