With the recent difficulties downloading I6 on Windows 11, I've been looking into code signing options. @dfabulich pointed me to https://signpath.org who provide free OV certificates for open source projects. The highest profile package I could see being signed by them is Vim, who have been using it for at least 6? years. Also Stellarium, VSCodium.
Using it would involve compiling and code signing in Github Actions, which is probably not too complex.
Their terms are at https://signpath.org/terms Things I noticed include:
- The binaries have to be build in CI, to ensure they're verifiable
- They require team members to use multi-factor authentication. Though if all commits to master were done through pull requests then you might already be doing it? (PR merges do say verified).
- You'd need to specify who the team members are.
- Compiling would need metadata
With the recent difficulties downloading I6 on Windows 11, I've been looking into code signing options. @dfabulich pointed me to https://signpath.org who provide free OV certificates for open source projects. The highest profile package I could see being signed by them is Vim, who have been using it for at least 6? years. Also Stellarium, VSCodium.
Using it would involve compiling and code signing in Github Actions, which is probably not too complex.
Their terms are at https://signpath.org/terms Things I noticed include: