Repository navigation
Correct release notes and docs: signing is not active - #31
Merged
Merged
Conversation
SignPath declined the free OSS signing application (not enough public usage history yet), but the release notes, README, and code-signing- policy.md all still stated "free code signing provided by SignPath.io" in the present tense as though it were live. Shipping unsigned binaries while claiming they're signed is exactly the kind of trust-mismatch this session has been fixing elsewhere; the docs site already had the honest wording, these three did not. All three now state plainly that builds are not signed yet, explain why (SignPath's traction requirement, no paid cert in place either), and point to SHA256SUMS verification and the SmartScreen "Run anyway" step. The team-roles section in code-signing-policy.md is kept, since it's the precondition SignPath requires before reapplying once the project has more usage history.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SignPath declined the free OSS signing application (not enough public usage history yet), but the release notes, README, and code-signing-policy.md all still claimed "free code signing provided by SignPath.io" in the present tense. Shipping unsigned binaries while the docs claim they're signed is exactly the trust-mismatch this session has been fixing elsewhere. The docs site (docs/site/index.html) already had the honest wording; these three didn't.
Change
All three now state plainly that builds aren't signed yet, explain why (SignPath's traction requirement, no paid cert in place), and point to SHA256SUMS verification and the SmartScreen "Run anyway" step. Kept the team-roles section in code-signing-policy.md since it's the precondition SignPath requires before reapplying later.
Test plan