Skip to content

signing-signpath.md

Latest commit

 

History

History
67 lines (53 loc) · 3.41 KB

signing-signpath.md

File metadata and controls

67 lines (53 loc) · 3.41 KB
Raw

Code signing — SignPath Foundation (free OV for OSS)

Vitreous ships unsigned today, so Windows SmartScreen shows a one-time "More info → Run anyway" on first run. To remove that, we sign the installer with the SignPath Foundation certificate — free for qualifying open-source projects. Publisher then reads "SignPath Foundation".

How it works (important)

SignPath is not a .pfx you install locally. It signs artifacts that were built in a trusted CI. The flow:

  1. GitHub Actions builds the unsigned installer (.github/workflows/release.yml).
  2. The workflow submits the .exe to SignPath's cloud.
  3. SignPath signs it with the Foundation certificate and returns the signed file.
  4. We regenerate latest.yml + .blockmap so electron-updater's hash matches the signed installer (skipping this silently breaks auto-update).
  5. The signed installer + metadata are attached to the GitHub Release.

It's an OV certificate (not EV), so SmartScreen still builds reputation over the first downloads — but a signed build clears the warning far faster than unsigned, and identifies the publisher.

Eligibility — where we stand

Requirement Status
Public GitHub repo ✅ subhasisbiswal012/Vitreous
OSI-approved license ✅ MIT
Built by a supported CI ✅ GitHub Actions workflow added
SignPath Foundation application approved ⬜ you must apply

Note: SignPath Foundation reviews each project for legitimacy/relevance. A brand-new project may be asked to show it's real and distributed — having this repo public, the download page live, and a first (even unsigned) release available strengthens the application. If they decline pre-release, publish one unsigned 0.1.0 first, then apply.

What YOU need to do (one-time)

  1. Go to https://signpath.org/apply and submit Vitreous (GitHub URL, MIT license). Use the public email subhasis.biswal.hustle@gmail.com.
  2. After approval, in the SignPath console:
    • Note your Organization ID.
    • Create a Project (slug vitreous) connected to the GitHub repo.
    • Create a Signing Policy (slug e.g. release-signing) using the Foundation cert.
    • Generate a CI user API token.
  3. In the GitHub repo → Settings → Secrets and variables → Actions, add:
    • Secret SIGNPATH_API_TOKEN = the API token.
    • Variable SIGNPATH_ORG_ID = your Organization ID.
    • Variable SIGNPATH_ENABLED = true (turns the signing job on).
  4. Tell me when that's done — I'll un-comment and finalize the sign job in release.yml (the scaffold is already there), wire the metadata regeneration script, and switch publishing to attach the signed artifacts.

What the CI does (maintainer side, mostly done)

  • release.yml builds the unsigned installer + latest.yml + .blockmap and uploads them as a workflow artifact (working now — testable via Run workflow).
  • The sign job (commented scaffold in release.yml) submits to SignPath, then a scripts/update-release-metadata.mjs step recomputes the sha512/size in latest.yml and regenerates the blockmap for the signed .exe before release.

Status

  • ✅ CI build workflow added (.github/workflows/release.yml).
  • ⬜ SignPath Foundation application (you) → secrets/variables → finalize sign job.
  • ⬜ Then: publish the first signed Release + point the download page CTA at it.