Skip to content

docs: clarify SignPath code signing is pending, not yet implemented #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Finesssee merged 1 commit into from
Aug 8, 2026
Merged

docs: clarify SignPath code signing is pending, not yet implemented #270

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Winget distribution is approved through [microsoft/winget-pkgs](https://github.c

## Code signing

> **Code signing:** Windows releases of Win-CodexBar are signed for free by SignPath.io, certificate by SignPath Foundation. See [docs/CODE_SIGNING.md](docs/CODE_SIGNING.md) for the signing policy.
> **Code signing:** Free signing via SignPath.io (certificate: SignPath Foundation) is **planned, pending onboarding — not yet wired into the release pipeline**. See [docs/CODE_SIGNING.md](docs/CODE_SIGNING.md) for the signing policy.
> Windows release installers are currently unsigned, which may cause an incorrect SmartScreen/Defender alert — verify the SHA-256 published alongside each release; see [docs/PRIVACY.md](docs/PRIVACY.md) for data handling.

## First Run
Expand Down
8 changes: 6 additions & 2 deletions docs/CODE_SIGNING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Code signing policy

Free code signing of Win-CodexBar releases provided by SignPath.io, certificate by SignPath Foundation.
Free code signing of Win-CodexBar releases via SignPath.io, certificate by SignPath Foundation.

> **Status: pending onboarding — not yet implemented.** All current release artifacts (installer and portable build) are **unsigned**; authenticity relies on the SHA-256 `.sha256` sidecar files published alongside each release. The sections below describe the target process once SignPath onboarding and pipeline wiring are complete.

## Project identity

Expand All @@ -23,13 +25,15 @@ Free code signing of Win-CodexBar releases provided by SignPath.io, certificate
- CI runs on GitHub Actions (`.github/workflows/pr-check.yml`).
- The Windows release pipeline is driven by `scripts/windows-release-build.ps1`, which builds the Tauri release binary plus the console CLI and packages them with Inno Setup into the installer (`CodexBar-<version>-Setup.exe`) and portable build, writing SHA-256 sidecar files for every artifact.
- Release artifacts are published to [GitHub Releases](https://github.com/nesszer/Win-CodexBar/releases).
- Release signing is submitted to SignPath from this pipeline; each release-signing request is approved manually by the approver listed above before signed binaries are published.
- **Not yet wired:** release signing will be submitted to SignPath from this pipeline once SignPath onboarding completes; each release-signing request is approved manually by the approver listed above before signed binaries are published.

## Privacy

See [docs/PRIVACY.md](PRIVACY.md) for the project's privacy policy.

## Notes

*The notes below apply once signing is active:*

- Certificates are issued in the SignPath Foundation's name; signed binaries show "SignPath Foundation" as the publisher.
- Every release-signing request requires manual approval per release; no unattended signing is performed.