Code signing policy

Free code signing of Win-CodexBar releases via SignPath.io, certificate by SignPath Foundation.

Status: SignPath Foundation approved — pipeline wiring in progress. The release workflow (.github/workflows/release.yml) includes SignPath signing steps; signing activates once the secrets (SIGNPATH_API_TOKEN, SIGNPATH_ORGANIZATION_ID, SIGNPATH_PROJECT_SLUG, SIGNPATH_SIGNING_POLICY_SLUG) are added to the GitHub repo. Until then, artifacts are unsigned with SHA-256 .sha256 sidecar files. See .signpath/SETUP.md for the onboarding checklist.

Project identity

• Project name: Win-CodexBar
• Homepage: https://github.com/nesszer/Win-CodexBar
• Source code: https://github.com/nesszer/Win-CodexBar
• Releases: https://github.com/nesszer/Win-CodexBar/releases
• License: MIT

Roles

Role
Author: Finesssee
Reviewer: Finesssee
Approver: Finesssee (@Finesssee)

Build system

• CI runs on GitHub Actions (.github/workflows/pr-check.yml).
• The Windows release pipeline is driven by scripts/windows-release-build.ps1, which builds the Tauri release binary plus the console CLI and packages them with Inno Setup into the installer (CodexBar-<version>-Setup.exe) and portable build, writing SHA-256 sidecar files for every artifact.
• Release artifacts are published to GitHub Releases.
• Not yet wired: release signing will be submitted to SignPath from this pipeline once SignPath onboarding completes; each release-signing request is approved manually by the approver listed above before signed binaries are published.

Privacy

See docs/PRIVACY.md for the project's privacy policy.

Notes

The notes below apply once signing is active:

• Certificates are issued in the SignPath Foundation's name; signed binaries show "SignPath Foundation" as the publisher.
• Every release-signing request requires manual approval per release; no unattended signing is performed.