SignPath Foundation

Web · API

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

SignPath Foundation is ranked #6 of 26 in code signing software on Freedom251. It runs on API, Web. There is a free plan.

SignPath Foundation plans and pricing

All plans

Free OSS SignPath.io subscription Free For eligible open-source projects · project must be actively maintained and released · OSI-approved license · every release requires manual signing approval signpath.org · 4 Oct 2026

Compared on code signing software

Free plan: Yes
Supported targets: Windows executables and scripts, MSI, CAB, AppX/MSIX, NuGet, Java archives, Android packages, RPM, Debian packages, Office macros, XML, JSON, OCI container images, ClickOnce, and arbitrary files
Certificate provided: Yes
Cloud signing: Yes
HSM key protection: Yes
Trusted timestamping: Yes
CI/CD signing: Yes
Approval workflows: Yes

Best SignPath Foundation alternatives

See all 20

Two bars AWS Signer Free tier No. 1Free6.6 Two bars Cosign Free tier No. 2Free6.6 Two bars SignPath Free tier No. 3Free6.6 Two bars SignServer Free tier No. 4Free6.6 Two bars Sigstore Free tier No. 5Free6.5 One bar DigiCert Software Trust Manager Paid plans No. 7—5.7

The record

Purpose: SignPath Foundation provides code-signing certificates to open-source projects to link published binaries to their repositories.
Signing service: The Foundation provides certificates through SignPath.io, which performs the code signing.
Key protection: SignPath says certificate private keys are securely generated and stored on a hardware security module.
Build verification: For each release, SignPath.io verifies that signed files are automated builds from the project’s stated source repository.
Build integrations: The documentation lists Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor as supported trusted build systems.
Approval requirement: Every release requires manual approval for signing.
Eligibility: Eligible projects must be actively maintained, already released, use an OSI-approved open-source license, and contain no proprietary code or malware.
Team security: All project team members must use multi-factor authentication for SignPath and source-code repository access.
Signing roles: Projects must define author, reviewer, and approver responsibilities, and a team member must approve each signing request.
Software restrictions: The Foundation does not sign software with features designed to identify or exploit vulnerabilities or bypass execution-environment security measures.
Certificate identity: The Foundation certificate is issued to SignPath Foundation, which is therefore named as the software publisher.
Acceptance discretion: The Foundation may accept or reject an application at its discretion and is under no obligation to accept a project.
Operator: SignPath Foundation says it is currently operated by SignPath GmbH, the company behind SignPath.io.
Headquarters: Vienna, Austria
Price from: Free

Where it ranks on Freedom251

Best Code Signing Software in 2026#6 of 26

Is SignPath Foundation yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote SignPath Foundation

Sources

signpath.org· checked 4 Oct 2026
signpath.org/about· checked 4 Oct 2026
signpath.org/terms· checked 4 Oct 2026
docs.signpath.io/trusted-build-systems/· checked 4 Oct 2026