Skip to content

Code signing: planned, not applied for #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
burnersen merged 1 commit into from
Oct 31, 2026
Merged

Code signing: planned, not applied for #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .signpath/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
# Code signing with SignPath: prepared, off until switched on

NVENCForge has applied to the [SignPath Foundation](https://signpath.org) for free
code signing of its Windows files. Everything for it is prepared here and in
NVENCForge plans to use free code signing from the [SignPath Foundation](https://signpath.org)
for its Windows files. A first application in October 2026 came too early: the Foundation
asks for more public visibility (stars, forks, external mentions), and is happy to review
it again later. Everything for it is prepared here and in
[`release.yml`](../.github/workflows/release.yml), but **it stays off** until it is
switched on below. Until then every release is built and published exactly as before,
unsigned, and its release text says so.
Expand Down
15 changes: 9 additions & 6 deletions CODE_SIGNING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
# Code signing policy

Free code signing provided by [SignPath.io](https://about.signpath.io),
certificate by [SignPath Foundation](https://signpath.org).

> **Status:** NVENCForge has applied to the SignPath Foundation. Until the
> signing is active, `NVENCForge.exe` is not signed. Every release says in
> its text whether its exe is signed.
> **Status:** `NVENCForge.exe` is not code signed yet. Free code signing
> through the [SignPath Foundation](https://signpath.org) is planned as soon as
> NVENCForge is known well enough to qualify. Everything for it is prepared, and
> this policy already describes how it will work. Every release says in its
> text whether its files are signed.
>
> Once signing is active: free code signing provided by
> [SignPath.io](https://about.signpath.io), certificate by
> [SignPath Foundation](https://signpath.org).

## What is signed

Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,7 +321,7 @@ The five worth knowing about:

## 🛡️ Windows SmartScreen / antivirus warnings

Windows or your antivirus may warn you the first time you run `NVENCForge.exe`. The honest reason: **the EXE is not code-signed yet.** Signing certificates cost several hundred euros *per year*, and this is a free hobby project with zero income. Free code signing through the [SignPath Foundation](https://signpath.org) is applied for and already prepared; see the [code signing policy](CODE_SIGNING.md). Until then, unsigned Go binaries are frequent false-positive targets, and all I can do is be transparent.
Windows or your antivirus may warn you the first time you run `NVENCForge.exe`. The honest reason: **the EXE is not code-signed yet.** Signing certificates cost several hundred euros *per year*, and this is a free hobby project with zero income. Free code signing through the [SignPath Foundation](https://signpath.org) is planned and already prepared, as soon as NVENCForge is known well enough to qualify; see the [code signing policy](CODE_SIGNING.md). Until then, unsigned Go binaries are frequent false-positive targets, and all I can do is be transparent.

Every release is built by GitHub Actions from this repository ([release workflow](.github/workflows/release.yml)), never on a private PC.

Expand Down
Loading