Skip to content

Code signing: planned, not applied for #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
burnersen merged 1 commit into from
Oct 31, 2026
Merged

Code signing: planned, not applied for #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .signpath/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
# Code signing with SignPath: prepared, off until switched on

TimeSync has applied to the [SignPath Foundation](https://signpath.org) for free
code signing of its Windows files. Everything for it is prepared here and in
TimeSync plans to use free code signing from the [SignPath Foundation](https://signpath.org)
for its Windows files. A first application in October 2026 came too early: the Foundation
asks for more public visibility (stars, forks, external mentions), and is happy to review
it again later. Everything for it is prepared here and in
[`release.yml`](../.github/workflows/release.yml), but **it stays off** until it is
switched on below. Until then every release is built and published exactly as before,
unsigned, and its release text says so.
Expand Down
15 changes: 9 additions & 6 deletions CODE_SIGNING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
# Code signing policy

Free code signing provided by [SignPath.io](https://about.signpath.io),
certificate by [SignPath Foundation](https://signpath.org).

> **Status:** TimeSync has applied to the SignPath Foundation. Until the
> signing is active, the Windows files of a release are not signed. Every
> release says in its text whether its files are signed.
> **Status:** The Windows files of a release are not code signed yet. Free code signing
> through the [SignPath Foundation](https://signpath.org) is planned as soon as
> TimeSync is known well enough to qualify. Everything for it is prepared, and
> this policy already describes how it will work. Every release says in its
> text whether its files are signed.
>
> Once signing is active: free code signing provided by
> [SignPath.io](https://about.signpath.io), certificate by
> [SignPath Foundation](https://signpath.org).

## What is signed

Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,8 @@ Edge WebView2 runtime, which is part of current Windows.
> **Windows SmartScreen** may warn because the files are not yet digitally
> signed. Choose "More info" → "Run anyway". The source code is all here,
> and every release is built by GitHub Actions from this repository.
> Free code signing through the SignPath Foundation is applied for; see the
> [code signing policy](CODE_SIGNING.md).
> Free code signing through the SignPath Foundation is planned as soon as
> TimeSync is known well enough to qualify; see the [code signing policy](CODE_SIGNING.md).

## How it decides

Expand Down
Loading