From 99f617d4d3a1649ab82ba5391be726c0cc67f9b1 Mon Sep 17 00:00:00 2001 From: Finesssee <90105158+Finesssee@users.noreply.github.com> Date: Sat, 8 Aug 2026 13:35:27 +0700 Subject: [PATCH] docs: clarify SignPath code signing is pending, not yet implemented README claimed releases are SignPath-signed while the next line said they are unsigned; CODE_SIGNING.md described a pipeline signing step that does not exist. Mark SignPath signing as planned/pending onboarding, label the unimplemented pipeline step, and state current artifacts are unsigned and verified via published SHA-256 sidecars. Refs #257 --- README.md | 2 +- docs/CODE_SIGNING.md | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 441005d555..c7abd87be8 100755 --- a/README.md +++ b/README.md @@ -43,7 +43,7 @@ Winget distribution is approved through [microsoft/winget-pkgs](https://github.c ## Code signing -> **Code signing:** Windows releases of Win-CodexBar are signed for free by SignPath.io, certificate by SignPath Foundation. See [docs/CODE_SIGNING.md](docs/CODE_SIGNING.md) for the signing policy. +> **Code signing:** Free signing via SignPath.io (certificate: SignPath Foundation) is **planned, pending onboarding — not yet wired into the release pipeline**. See [docs/CODE_SIGNING.md](docs/CODE_SIGNING.md) for the signing policy. > Windows release installers are currently unsigned, which may cause an incorrect SmartScreen/Defender alert — verify the SHA-256 published alongside each release; see [docs/PRIVACY.md](docs/PRIVACY.md) for data handling. ## First Run diff --git a/docs/CODE_SIGNING.md b/docs/CODE_SIGNING.md index 3f48d33b2c..56f3a63614 100644 --- a/docs/CODE_SIGNING.md +++ b/docs/CODE_SIGNING.md @@ -1,6 +1,8 @@ # Code signing policy -Free code signing of Win-CodexBar releases provided by SignPath.io, certificate by SignPath Foundation. +Free code signing of Win-CodexBar releases via SignPath.io, certificate by SignPath Foundation. + +> **Status: pending onboarding — not yet implemented.** All current release artifacts (installer and portable build) are **unsigned**; authenticity relies on the SHA-256 `.sha256` sidecar files published alongside each release. The sections below describe the target process once SignPath onboarding and pipeline wiring are complete. ## Project identity @@ -23,7 +25,7 @@ Free code signing of Win-CodexBar releases provided by SignPath.io, certificate - CI runs on GitHub Actions (`.github/workflows/pr-check.yml`). - The Windows release pipeline is driven by `scripts/windows-release-build.ps1`, which builds the Tauri release binary plus the console CLI and packages them with Inno Setup into the installer (`CodexBar--Setup.exe`) and portable build, writing SHA-256 sidecar files for every artifact. - Release artifacts are published to [GitHub Releases](https://github.com/nesszer/Win-CodexBar/releases). -- Release signing is submitted to SignPath from this pipeline; each release-signing request is approved manually by the approver listed above before signed binaries are published. +- **Not yet wired:** release signing will be submitted to SignPath from this pipeline once SignPath onboarding completes; each release-signing request is approved manually by the approver listed above before signed binaries are published. ## Privacy @@ -31,5 +33,7 @@ See [docs/PRIVACY.md](PRIVACY.md) for the project's privacy policy. ## Notes +*The notes below apply once signing is active:* + - Certificates are issued in the SignPath Foundation's name; signed binaries show "SignPath Foundation" as the publisher. - Every release-signing request requires manual approval per release; no unattended signing is performed.