Code signing policy¶
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
Status: the application to SignPath Foundation is open (#64). Releases are not signed yet.
What we sign¶
The release workflow signs only the files that the CmdWarden team builds from this repository. Release signing lists each file. Third-party files keep the signature of their owner.
Each signed file has the product name CmdWarden and the version of the release.
Team roles¶
| Role | Members |
|---|---|
| Committers and reviewers | BasantPandey |
| Approvers | BasantPandey |
- A committer changes the source code with no other review.
- A reviewer checks each pull request from a person who is not a committer.
- An approver approves each signing request by hand.
Every team member uses multi-factor authentication for GitHub and for SignPath.
How a release gets signed¶
- A team member pushes a version tag.
- The release workflow builds every file from the source on GitHub Actions.
- The workflow sends the files to SignPath.
- An approver approves the signing request.
- The workflow checks each signature, then publishes the release.
Privacy¶
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
Trust lists each command that uses the network, and the host it talks to.
Report a problem¶
Open an issue at github.com/BasantPandey/CmdWarden/issues. For a security problem, follow Report a problem.