From 5882c1e676b347a87099bde9e4c60db5a113f848 Mon Sep 17 00:00:00 2001 From: Daniel Date: Thu, 30 Jul 2026 15:41:09 +0100 Subject: [PATCH] Correct release notes, README and policy: signing is not active SignPath declined the free OSS signing application (not enough public usage history yet), but the release notes, README, and code-signing- policy.md all still stated "free code signing provided by SignPath.io" in the present tense as though it were live. Shipping unsigned binaries while claiming they're signed is exactly the kind of trust-mismatch this session has been fixing elsewhere; the docs site already had the honest wording, these three did not. All three now state plainly that builds are not signed yet, explain why (SignPath's traction requirement, no paid cert in place either), and point to SHA256SUMS verification and the SmartScreen "Run anyway" step. The team-roles section in code-signing-policy.md is kept, since it's the precondition SignPath requires before reapplying once the project has more usage history. --- .github/workflows/release.yml | 20 ++++++++++++-------- README.md | 15 ++++++++++----- docs/code-signing-policy.md | 31 +++++++++++++++++++------------ 3 files changed, 41 insertions(+), 25 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3a12b5c..ad97df4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -305,14 +305,18 @@ jobs: desktop app, superseded by the Electron client above. It is still built so existing setups keep working. - ## Code signing policy - - Free code signing provided by [SignPath.io](https://signpath.io), - certificate by [SignPath Foundation](https://signpath.org). - - Committers and reviewers: [repository maintainers](https://github.com/dbisina/relay/graphs/contributors). - Approvers: [repository owner](https://github.com/dbisina). - Every release is approved manually before it is signed. + ## About the security warning + + These builds are **not code-signed** yet, so Windows SmartScreen and some + antivirus tools will warn on first run. This is expected for a project this + new: free signing from [SignPath.io](https://signpath.io) requires more + public usage history than the project has built up so far, and a paid + certificate is not yet in place. Neither means the binary is unsafe, only + that it has no publisher reputation attached to it yet. + + To run it anyway on Windows: click "More info", then "Run anyway" on the + SmartScreen prompt. Verify the download matches `SHA256SUMS` first if you + want extra assurance. Relay runs locally and will not transfer any information to other networked systems unless specifically requested by the user or the diff --git a/README.md b/README.md index dfe1b4b..03e68ab 100644 --- a/README.md +++ b/README.md @@ -253,14 +253,19 @@ Repo map for contributing agents: [CODEMAP.md](CODEMAP.md). Agent rules: [CLAUDE ## Code signing policy -Release binaries and installers are code signed so Windows and macOS can verify -they came from this project and were not modified after they were built. +Release binaries and installers are **not code signed yet**. Windows +SmartScreen and some antivirus tools will warn on first run as a result; +click "More info" then "Run anyway", or verify the download against +`SHA256SUMS` first if you want assurance beyond that. -Free code signing provided by [SignPath.io](https://signpath.io), certificate by -[SignPath Foundation](https://signpath.org). +Relay applied to [SignPath.io](https://signpath.io)'s free open source +signing program (certificates from [SignPath Foundation](https://signpath.org)) +and was told the project needs more public usage history to qualify. The +team-roles structure below is the precondition SignPath requires before +reapplying. - **Committers and reviewers:** [repository maintainers](https://github.com/dbisina/relay/graphs/contributors). Changes from outside the maintainers arrive as pull requests and are reviewed before merge. -- **Approvers:** [repository owner](https://github.com/dbisina). Every release is approved manually before it is signed. +- **Approvers:** [repository owner](https://github.com/dbisina). Once signing is active, every release will be approved manually before it is signed. Relay runs locally and will not transfer any information to other networked systems unless specifically requested by the user or the person installing or diff --git a/docs/code-signing-policy.md b/docs/code-signing-policy.md index 16b7e4f..5b460e5 100644 --- a/docs/code-signing-policy.md +++ b/docs/code-signing-policy.md @@ -1,11 +1,18 @@ # Code signing policy -Relay's release binaries and installers are code signed so that Windows and -macOS can verify they came from this project and were not tampered with after -they were built. - -Free code signing provided by [SignPath.io](https://signpath.io), certificate by -[SignPath Foundation](https://signpath.org). +**Current status: Relay's release binaries and installers are not code +signed yet.** Windows SmartScreen and some antivirus tools will warn on +first run as a result; this does not mean the binary is unsafe, only that +it carries no publisher reputation yet. Verify a download against +`SHA256SUMS` below if you want assurance beyond that. + +Relay applied to [SignPath.io](https://signpath.io)'s free open source +signing program (certificates from [SignPath Foundation](https://signpath.org)) +and was told the project does not yet have enough public usage history to +qualify. This page, and the team-roles structure below, exist as the +precondition SignPath requires before reapplying once that changes. A paid +certificate is the other path back to signed releases and is not currently +in place either. ## Team roles @@ -19,11 +26,11 @@ Relay is maintained in the open at request for a release is approved manually. No release is signed automatically without that approval. -## What gets signed +## What will get signed -Only artefacts built by this project's own release pipeline -([`.github/workflows/release.yml`](../.github/workflows/release.yml)) from -source in this repository: +Once signing is active, only artefacts built by this project's own release +pipeline ([`.github/workflows/release.yml`](../.github/workflows/release.yml)) +from source in this repository: - the `relay` daemon and CLI binary, - the Electron desktop installers (`.exe`, `.dmg`, `.AppImage`), @@ -67,7 +74,7 @@ Get-FileHash .\Relay--windows-x64-setup.exe -Algorithm SHA256 ## Reporting a problem -If you believe a signed Relay artefact violates the SignPath Foundation code of -conduct, please open an issue at +If you believe a Relay artefact (signed or not) violates the SignPath +Foundation code of conduct, please open an issue at [github.com/dbisina/relay/issues](https://github.com/dbisina/relay/issues) and contact `support@signpath.io` with details.