SignPath Foundation

What SignPath Foundation is

SignPath Foundation provides code-signing certificates to eligible open-source projects, linking published binaries to their repositories. SignPath.io performs the signing and checks that signed files for each release are automated builds from the project’s stated source repository. Certificate private keys are generated and kept on a hardware security module. Every release requires manual approval, with projects defining author, reviewer, and approver responsibilities and a team member approving each request. Eligible projects must be actively maintained, already released, use an OSI-approved open-source license, and contain no proprietary code or malware. Team members must use multi-factor authentication for SignPath and repository access. Supported trusted build systems include Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor. The free subscription is for eligible open-source projects. The certificate names SignPath Foundation as the publisher, and the Foundation may accept or reject applications at its discretion.

Who it suits

SignPath Foundation is for actively maintained, released open-source projects that meet its licensing and content requirements. Teams must be prepared to use multi-factor authentication and require manual approval for every signing release.

Limits

The free subscription is limited to eligible open-source projects that are actively maintained, already released, licensed under an OSI-approved license, and contain no proprietary code or malware. Every release requires manual signing approval.

Getting started

1. Review the project eligibility requirements on the SignPath Foundation website.
2. Apply for the free subscription; acceptance is at the Foundation’s discretion.
3. Ensure all project team members use multi-factor authentication for SignPath and repository access.
4. Set up a supported trusted build system.
5. Define author, reviewer and approver responsibilities, then have a team member approve each signing request.

Verdict

SignPath Foundation offers signing certificates for qualifying open-source projects, with build verification and protected keys. Manual approval is required for each release, and applying does not guarantee acceptance.