From f7249d019e60c3b4a1c1cc220a16ac63b43af3c2 Mon Sep 17 00:00:00 2001 From: Scott Converse Date: Sat, 27 Jun 2026 17:09:03 -0600 Subject: [PATCH] Add CODE_SIGNING_POLICY.md for SignPath Foundation prep --- CODE_SIGNING_POLICY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 CODE_SIGNING_POLICY.md diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md new file mode 100644 index 0000000..f4c19d3 --- /dev/null +++ b/CODE_SIGNING_POLICY.md @@ -0,0 +1,25 @@ +# Code Signing Policy + +This project signs and distributes release artifacts. + +## Windows — SignPath Foundation +Free code signing provided by SignPath.io, certificate by SignPath Foundation. + +### What is signed +- Windows installer/executable artifacts published on GitHub Releases + +### Build and signing process +- Artifacts are built from this repository using GitHub Actions (GitHub-hosted runners only) +- Only CI-built artifacts are submitted to SignPath for signing +- The private key is held by SignPath (HSM-backed); this project does not store the private key + +### Team roles +- Author (commit access): https://github.com/scottconverse +- Approver (approves each signing request): https://github.com/scottconverse +- Policy: Each signing request requires explicit approval by the maintainer + +## Distribution +Signed releases are published at: https://github.com/scottconverse/civicrecords-ai/releases + +## Privacy +This software will not transfer any information to other networked systems unless specifically requested by the user.