From 89349ca07b8dca34cffd838b83295f179ca585f6 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 08:48:18 +0000 Subject: [PATCH] Code signing: planned, not applied for The first application to the SignPath Foundation (October 2026) came too early: the Foundation asks for more public visibility first, and is happy to review the project again later. The README, CODE_SIGNING.md and .signpath/README.md now say that code signing is planned once NVENCForge is known well enough, instead of "applied for". Everything for it stays prepared. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GvUq7HnA5ggbuHBogzS2rV --- .signpath/README.md | 6 ++++-- CODE_SIGNING.md | 15 +++++++++------ README.md | 2 +- 3 files changed, 14 insertions(+), 9 deletions(-) diff --git a/.signpath/README.md b/.signpath/README.md index 3bb3afb..6a98586 100644 --- a/.signpath/README.md +++ b/.signpath/README.md @@ -1,7 +1,9 @@ # Code signing with SignPath: prepared, off until switched on -NVENCForge has applied to the [SignPath Foundation](https://signpath.org) for free -code signing of its Windows files. Everything for it is prepared here and in +NVENCForge plans to use free code signing from the [SignPath Foundation](https://signpath.org) +for its Windows files. A first application in October 2026 came too early: the Foundation +asks for more public visibility (stars, forks, external mentions), and is happy to review +it again later. Everything for it is prepared here and in [`release.yml`](../.github/workflows/release.yml), but **it stays off** until it is switched on below. Until then every release is built and published exactly as before, unsigned, and its release text says so. diff --git a/CODE_SIGNING.md b/CODE_SIGNING.md index 93dc41e..e7e0d13 100644 --- a/CODE_SIGNING.md +++ b/CODE_SIGNING.md @@ -1,11 +1,14 @@ # Code signing policy -Free code signing provided by [SignPath.io](https://about.signpath.io), -certificate by [SignPath Foundation](https://signpath.org). - -> **Status:** NVENCForge has applied to the SignPath Foundation. Until the -> signing is active, `NVENCForge.exe` is not signed. Every release says in -> its text whether its exe is signed. +> **Status:** `NVENCForge.exe` is not code signed yet. Free code signing +> through the [SignPath Foundation](https://signpath.org) is planned as soon as +> NVENCForge is known well enough to qualify. Everything for it is prepared, and +> this policy already describes how it will work. Every release says in its +> text whether its files are signed. +> +> Once signing is active: free code signing provided by +> [SignPath.io](https://about.signpath.io), certificate by +> [SignPath Foundation](https://signpath.org). ## What is signed diff --git a/README.md b/README.md index 90295d9..6640610 100644 --- a/README.md +++ b/README.md @@ -321,7 +321,7 @@ The five worth knowing about: ## 🛡️ Windows SmartScreen / antivirus warnings -Windows or your antivirus may warn you the first time you run `NVENCForge.exe`. The honest reason: **the EXE is not code-signed yet.** Signing certificates cost several hundred euros *per year*, and this is a free hobby project with zero income. Free code signing through the [SignPath Foundation](https://signpath.org) is applied for and already prepared; see the [code signing policy](CODE_SIGNING.md). Until then, unsigned Go binaries are frequent false-positive targets, and all I can do is be transparent. +Windows or your antivirus may warn you the first time you run `NVENCForge.exe`. The honest reason: **the EXE is not code-signed yet.** Signing certificates cost several hundred euros *per year*, and this is a free hobby project with zero income. Free code signing through the [SignPath Foundation](https://signpath.org) is planned and already prepared, as soon as NVENCForge is known well enough to qualify; see the [code signing policy](CODE_SIGNING.md). Until then, unsigned Go binaries are frequent false-positive targets, and all I can do is be transparent. Every release is built by GitHub Actions from this repository ([release workflow](.github/workflows/release.yml)), never on a private PC.