SignPath Foundation

What SignPath Foundation is

SignPath Foundation provides code-signing certificates to eligible open-source projects, linking published binaries to their source repositories. SignPath.io performs the signing and checks that each release’s signed files are automated builds from the project’s stated repository. Certificate private keys are generated and kept on a hardware security module. Every release needs manual approval, and projects must assign author, reviewer, and approver responsibilities, with a team member approving each request. Eligible projects must be actively maintained, have an existing release, use an OSI-approved open-source license, and contain neither proprietary code nor malware. Team members must use multi-factor authentication for both SignPath and repository access. Supported trusted build systems include Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor. The service supports signing many file types, including Windows executables, Android packages, Java archives, Debian and RPM packages, and OCI container images. Its free subscription is for eligible open-source projects. The certificate identifies SignPath Foundation as the publisher, and the Foundation can decline applications.