zhaolei
3c72efcb7f
Some checks failed
build-packages / resolve bundled mosh-client (push) Has been cancelled
build-packages / resolve bundled et-client (push) Has been cancelled
build-packages / build-macos (push) Has been cancelled
build-packages / build-windows (push) Has been cancelled
build-packages / build-linux-x64 (push) Has been cancelled
build-packages / build-linux-arm64 (push) Has been cancelled
build-packages / release (push) Has been cancelled
build-packages / update Nix release metadata (push) Has been cancelled
build-packages / bump homebrew tap (push) Has been cancelled
test / lint-and-test (push) Has been cancelled
AI automation / Route event (push) Has been cancelled
AI automation / Hand reopened issue to maintainers (push) Has been cancelled
AI automation / Clean source issue state (push) Has been cancelled
AI automation / Reconcile handoffs (push) Has been cancelled
AI automation / Classify issue (push) Has been cancelled
AI automation / Claude Code smoke (push) Has been cancelled
AI automation / Review issue follow-up (push) Has been cancelled
AI automation / Publish issue follow-up (push) Has been cancelled
AI automation / Implement with Claude Code (push) Has been cancelled
AI automation / Publish implement PR (push) Has been cancelled
AI automation / Continue queued issue comments (push) Has been cancelled
AI automation / Codex review loop (push) Has been cancelled
AI automation / Publish Codex fix (push) Has been cancelled
AI automation / Clear Codex dispatch marker (push) Has been cancelled
AI automation / Own PR re-request Codex (push) Has been cancelled
AI automation / External PR re-request Codex (push) Has been cancelled
AI automation / Poll Codex reaction / retry (push) Has been cancelled
build-et-binaries / build-linux-x64 (push) Has been cancelled
build-et-binaries / build-linux-arm64 (push) Has been cancelled
build-et-binaries / build-macos-universal (push) Has been cancelled
build-et-binaries / build-windows-x64 (push) Has been cancelled
build-et-binaries / release (push) Has been cancelled
56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
# Netcatty Code Signing Policy
|
|
|
|
## Status
|
|
|
|
Netcatty is applying to the SignPath Foundation open-source program. Once the
|
|
application and artifact scope are approved, covered Windows release artifacts
|
|
will use **Free code signing provided by SignPath.io, certificate by SignPath Foundation**.
|
|
Until that approval and integration are complete, Windows release artifacts may
|
|
remain unsigned.
|
|
|
|
SignPath eligibility and the permitted artifact scope are still subject to
|
|
SignPath Foundation review, including review of separately licensed third-party
|
|
components bundled with optional integrations. Netcatty will not represent an
|
|
artifact as SignPath-signed until that review is complete.
|
|
|
|
## Source and release provenance
|
|
|
|
- Official source repository:
|
|
[binaricat/Netcatty](https://github.com/binaricat/Netcatty)
|
|
- Official releases:
|
|
[GitHub Releases](https://github.com/binaricat/Netcatty/releases)
|
|
- Release artifacts are built from the official repository with GitHub
|
|
Actions.
|
|
- Signing requests must originate from the approved build workflow and source
|
|
revision.
|
|
- A maintainer must approve every production signing request.
|
|
- Third-party binaries are outside the Netcatty publisher-signing scope unless
|
|
SignPath Foundation explicitly approves them. They retain their upstream
|
|
signatures or remain unsigned.
|
|
|
|
## Roles
|
|
|
|
The project is currently maintained by an individual maintainer.
|
|
|
|
- Committer and reviewer: [binaricat](https://github.com/binaricat)
|
|
- Signing approver: [binaricat](https://github.com/binaricat)
|
|
|
|
Changes from other contributors are accepted through pull requests and must be
|
|
reviewed before merge. Changes to release workflows, signing policy, artifact
|
|
configuration, or signing permissions require maintainer review.
|
|
|
|
## Key protection and revocation
|
|
|
|
Netcatty maintainers do not receive or store the SignPath Foundation private
|
|
key. Signing is performed by SignPath.io under the approved project and
|
|
artifact policies.
|
|
|
|
If a signed artifact, release workflow, maintainer account, or signing request
|
|
is suspected to be compromised, the project will stop signing and publishing,
|
|
investigate the incident, notify SignPath Foundation, and request revocation
|
|
when appropriate.
|
|
|
|
## Privacy
|
|
|
|
See the [Netcatty Privacy Policy](PRIVACY.md).
|