Ship a self-contained wikven binary for Windows, like the Linux ones, so Windows users get the no-Docker experience.
Upstream tracking issue: php/frankenphp#2503. It is the same request one layer down, and it is what has to close before this one can.
Why it isn't done yet
Two independent gates, and both have to open.
1. Toolchain
wikven's binary is a single, self-contained, statically-linked file that embeds the whole MediaWiki + extension tree. It is produced by FrankenPHP's build-static.sh, which uses static-php-cli to compile a static PHP and embeds the app with --with-frankenphp-app.
FrankenPHP has native Windows support as of March 2026 (php/frankenphp#2119), but it dynamically links against the official PHP DLLs, so the PHP runtime must ship alongside it. The static path is the one still missing (frankenphp#2501 documents the current Linux/macOS-only state), and it is moving:
- The embed SAPI on Windows landed: static-php-cli closed #442 as completed in April 2026.
- The
frankenphp SAPI on Windows is documented too, but only on the unreleased v3 branch. Its docs list --build-frankenphp as producing buildroot/bin/frankenphp.exe (rendered, source), #1201 (merged 2026-07-08) fixed that target's Windows link, and a static frankenphp.exe (PHP 8.5 ZTS) has been built and served pages in testing. A PowerShell counterpart to build-static.sh is a WIP branch.
- None of it is released. The latest static-php-cli tag is 2.8.5 (2026-04-18), and per the maintainer on frankenphp#2503 v3 still needs work, with
build-static.sh to be dropped in favour of a craft.yml once it lands. So the mechanism wikven builds against will change shape before this is usable.
2. Distribution: code signing
Even with a working .exe, shipping it unsigned recreates the problem that keeps macOS binaries unpublished. docs/Standalone binary.wikitext already records the macOS reasoning: Gatekeeper requires signing and notarization through the Apple Developer Program at US$99/year, and telling users to clear the quarantine flag by hand trains them to bypass a security check. On Windows an unsigned download is met by SmartScreen and Defender ("Windows protected your PC") instead, which is the same bargain. Clearing it costs money, in one of three ways:
| route |
cost |
catch |
| Commercial Authenticode (OV) |
roughly US$200-600/year |
since June 2023 the CA/Browser Forum requires the private key on FIPS 140-2 Level 2 hardware, so the cheap software-only certificates are gone and a token or cloud HSM is part of the price |
| Microsoft Trusted Signing |
US$9.99/month, about US$120/year |
the individual tier is limited to the United States and Canada and requires identity validation through Entra Verified ID; the organisation tier wants a legal entity with three years of history |
| SignPath Foundation |
free |
only for qualifying open source projects, and signing runs through their managed pipeline, so the release workflow has to hand the artifact to a third party |
Unlike macOS this is not a flat no, because the Foundation route exists at all. Whether wikven would qualify is untested: its conditions are met on licensing (GPL-3.0-or-later, no dual licensing) and on having no proprietary components, but they also require separate Author, Reviewer and Approver roles with code review, per-release manual approval, MFA for everyone, and a published code signing policy. That role separation is the awkward part for a project with one maintainer. Either way the route puts an external service in the release chain, holding the signing identity, which is a project decision rather than a build detail.
Current recommendation for Windows users
Use the Docker image (ghcr.io/chaotic-ground/wikven) via Docker Desktop or WSL2. The Linux binary also runs unchanged inside WSL2. This is documented on the Standalone binary and Installation pages.
Revisit when
Signing is the gate, not the toolchain. php/frankenphp#2503 closing would make a Windows binary buildable but not shippable, and the project is not paying for a certificate. The free route, SignPath Foundation, wants separate Author, Reviewer and Approver roles with code review, which a single maintainer cannot satisfy.
So this stays open and unplanned rather than waiting on anything. What would change it is a signing arrangement that costs the project neither money nor a review process it has no people for.
🤖 Generated with Claude Code
Ship a self-contained
wikvenbinary for Windows, like the Linux ones, so Windows users get the no-Docker experience.Upstream tracking issue: php/frankenphp#2503. It is the same request one layer down, and it is what has to close before this one can.
Why it isn't done yet
Two independent gates, and both have to open.
1. Toolchain
wikven's binary is a single, self-contained, statically-linked file that embeds the whole MediaWiki + extension tree. It is produced by FrankenPHP's
build-static.sh, which uses static-php-cli to compile a static PHP and embeds the app with--with-frankenphp-app.FrankenPHP has native Windows support as of March 2026 (php/frankenphp#2119), but it dynamically links against the official PHP DLLs, so the PHP runtime must ship alongside it. The static path is the one still missing (frankenphp#2501 documents the current Linux/macOS-only state), and it is moving:
frankenphpSAPI on Windows is documented too, but only on the unreleased v3 branch. Its docs list--build-frankenphpas producingbuildroot/bin/frankenphp.exe(rendered, source), #1201 (merged 2026-07-08) fixed that target's Windows link, and a staticfrankenphp.exe(PHP 8.5 ZTS) has been built and served pages in testing. A PowerShell counterpart tobuild-static.shis a WIP branch.build-static.shto be dropped in favour of acraft.ymlonce it lands. So the mechanism wikven builds against will change shape before this is usable.2. Distribution: code signing
Even with a working
.exe, shipping it unsigned recreates the problem that keeps macOS binaries unpublished.docs/Standalone binary.wikitextalready records the macOS reasoning: Gatekeeper requires signing and notarization through the Apple Developer Program at US$99/year, and telling users to clear the quarantine flag by hand trains them to bypass a security check. On Windows an unsigned download is met by SmartScreen and Defender ("Windows protected your PC") instead, which is the same bargain. Clearing it costs money, in one of three ways:Unlike macOS this is not a flat no, because the Foundation route exists at all. Whether wikven would qualify is untested: its conditions are met on licensing (GPL-3.0-or-later, no dual licensing) and on having no proprietary components, but they also require separate Author, Reviewer and Approver roles with code review, per-release manual approval, MFA for everyone, and a published code signing policy. That role separation is the awkward part for a project with one maintainer. Either way the route puts an external service in the release chain, holding the signing identity, which is a project decision rather than a build detail.
Current recommendation for Windows users
Use the Docker image (
ghcr.io/chaotic-ground/wikven) via Docker Desktop or WSL2. The Linux binary also runs unchanged inside WSL2. This is documented on the Standalone binary and Installation pages.Revisit when
Signing is the gate, not the toolchain. php/frankenphp#2503 closing would make a Windows binary buildable but not shippable, and the project is not paying for a certificate. The free route, SignPath Foundation, wants separate Author, Reviewer and Approver roles with code review, which a single maintainer cannot satisfy.
So this stays open and unplanned rather than waiting on anything. What would change it is a signing arrangement that costs the project neither money nor a review process it has no people for.
🤖 Generated with Claude Code