From 1e273f27a6a861b5a04202564eef188d8bc4239a Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 08:48:16 +0000 Subject: [PATCH] Code signing: planned, not applied for The first application to the SignPath Foundation (October 2026) came too early: the Foundation asks for more public visibility first, and is happy to review the project again later. The README, CODE_SIGNING.md and .signpath/README.md now say that code signing is planned once TimeSync is known well enough, instead of "applied for". Everything for it stays prepared. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GvUq7HnA5ggbuHBogzS2rV --- .signpath/README.md | 6 ++++-- CODE_SIGNING.md | 15 +++++++++------ README.md | 4 ++-- 3 files changed, 15 insertions(+), 10 deletions(-) diff --git a/.signpath/README.md b/.signpath/README.md index d8c83b7..f4cd498 100644 --- a/.signpath/README.md +++ b/.signpath/README.md @@ -1,7 +1,9 @@ # Code signing with SignPath: prepared, off until switched on -TimeSync has applied to the [SignPath Foundation](https://signpath.org) for free -code signing of its Windows files. Everything for it is prepared here and in +TimeSync plans to use free code signing from the [SignPath Foundation](https://signpath.org) +for its Windows files. A first application in October 2026 came too early: the Foundation +asks for more public visibility (stars, forks, external mentions), and is happy to review +it again later. Everything for it is prepared here and in [`release.yml`](../.github/workflows/release.yml), but **it stays off** until it is switched on below. Until then every release is built and published exactly as before, unsigned, and its release text says so. diff --git a/CODE_SIGNING.md b/CODE_SIGNING.md index 91c0d81..486605c 100644 --- a/CODE_SIGNING.md +++ b/CODE_SIGNING.md @@ -1,11 +1,14 @@ # Code signing policy -Free code signing provided by [SignPath.io](https://about.signpath.io), -certificate by [SignPath Foundation](https://signpath.org). - -> **Status:** TimeSync has applied to the SignPath Foundation. Until the -> signing is active, the Windows files of a release are not signed. Every -> release says in its text whether its files are signed. +> **Status:** The Windows files of a release are not code signed yet. Free code signing +> through the [SignPath Foundation](https://signpath.org) is planned as soon as +> TimeSync is known well enough to qualify. Everything for it is prepared, and +> this policy already describes how it will work. Every release says in its +> text whether its files are signed. +> +> Once signing is active: free code signing provided by +> [SignPath.io](https://about.signpath.io), certificate by +> [SignPath Foundation](https://signpath.org). ## What is signed diff --git a/README.md b/README.md index e51f983..1c5cf12 100644 --- a/README.md +++ b/README.md @@ -53,8 +53,8 @@ Edge WebView2 runtime, which is part of current Windows. > **Windows SmartScreen** may warn because the files are not yet digitally > signed. Choose "More info" → "Run anyway". The source code is all here, > and every release is built by GitHub Actions from this repository. -> Free code signing through the SignPath Foundation is applied for; see the -> [code signing policy](CODE_SIGNING.md). +> Free code signing through the SignPath Foundation is planned as soon as +> TimeSync is known well enough to qualify; see the [code signing policy](CODE_SIGNING.md). ## How it decides