56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
|
# Netcatty Code Signing Policy
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
Netcatty is applying to the SignPath Foundation open-source program. Once the
|
||
|
|
application and artifact scope are approved, covered Windows release artifacts
|
||
|
|
will use **Free code signing provided by SignPath.io, certificate by SignPath Foundation**.
|
||
|
|
Until that approval and integration are complete, Windows release artifacts may
|
||
|
|
remain unsigned.
|
||
|
|
|
||
|
|
SignPath eligibility and the permitted artifact scope are still subject to
|
||
|
|
SignPath Foundation review, including review of separately licensed third-party
|
||
|
|
components bundled with optional integrations. Netcatty will not represent an
|
||
|
|
artifact as SignPath-signed until that review is complete.
|
||
|
|
|
||
|
|
## Source and release provenance
|
||
|
|
|
||
|
|
- Official source repository:
|
||
|
|
[binaricat/Netcatty](https://github.com/binaricat/Netcatty)
|
||
|
|
- Official releases:
|
||
|
|
[GitHub Releases](https://github.com/binaricat/Netcatty/releases)
|
||
|
|
- Release artifacts are built from the official repository with GitHub
|
||
|
|
Actions.
|
||
|
|
- Signing requests must originate from the approved build workflow and source
|
||
|
|
revision.
|
||
|
|
- A maintainer must approve every production signing request.
|
||
|
|
- Third-party binaries are outside the Netcatty publisher-signing scope unless
|
||
|
|
SignPath Foundation explicitly approves them. They retain their upstream
|
||
|
|
signatures or remain unsigned.
|
||
|
|
|
||
|
|
## Roles
|
||
|
|
|
||
|
|
The project is currently maintained by an individual maintainer.
|
||
|
|
|
||
|
|
- Committer and reviewer: [binaricat](https://github.com/binaricat)
|
||
|
|
- Signing approver: [binaricat](https://github.com/binaricat)
|
||
|
|
|
||
|
|
Changes from other contributors are accepted through pull requests and must be
|
||
|
|
reviewed before merge. Changes to release workflows, signing policy, artifact
|
||
|
|
configuration, or signing permissions require maintainer review.
|
||
|
|
|
||
|
|
## Key protection and revocation
|
||
|
|
|
||
|
|
Netcatty maintainers do not receive or store the SignPath Foundation private
|
||
|
|
key. Signing is performed by SignPath.io under the approved project and
|
||
|
|
artifact policies.
|
||
|
|
|
||
|
|
If a signed artifact, release workflow, maintainer account, or signing request
|
||
|
|
is suspected to be compromised, the project will stop signing and publishing,
|
||
|
|
investigate the incident, notify SignPath Foundation, and request revocation
|
||
|
|
when appropriate.
|
||
|
|
|
||
|
|
## Privacy
|
||
|
|
|
||
|
|
See the [Netcatty Privacy Policy](PRIVACY.md).
|