Code signing policy

What is signed

The Windows releases of the NextERP desktop app: the setup program (.exe), the Windows Installer package (.msi) and the app inside them. Only files built from this project's own source code are signed. Components from other open-source projects that are included in the installer keep their own signatures, or none.

Signing through SignPath Foundation starts with the first release after the project's application is approved. Until then, Windows releases are unsigned, and their release notes say so.

How a release is built

1. Every change is made in the public repository github.com/KiruiElisha/NextERP.
2. A release is a version tag (desktop-v…) on the main branch. GitHub Actions builds the installers from that tagged commit, with the workflow in .github/workflows/release-desktop.yml; nothing built on a developer's computer is signed.
3. The unsigned Windows files go to SignPath, which checks that they came from that build of that repository.
4. An approver reviews the release and approves it in SignPath. Every release needs this manual approval.
5. The signed files are published on GitHub releases, with their SHA-256 checksums, and offered on the download page.

All signed files carry the product name NextERP and the release's version number.

Team roles

Role	Who	What they do
Committers	@KiruiElisha	Trusted to change the source code without further review.
Reviewers	@KiruiElisha	Review every change proposed by anyone who is not a committer (pull requests) before it is merged.
Approvers	@KiruiElisha	Decide whether a release may be signed, and approve each signing request.

Everyone in these roles uses multi-factor authentication on GitHub and on SignPath. The list of people with access is on the repository's contributors page.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. The details, including the services it contacts when you use them, are in the privacy policy.

Installing and removing

The installer adds the app and a Start menu entry. If Microsoft Edge WebView2 (part of current Windows) is missing, it installs it from Microsoft, as the app needs it to draw its window. It changes nothing else on the system. It can be removed at any time from Settings → Apps → Installed apps. See install and uninstall for every platform.

Reporting a problem

If you think a signed file is malicious, was not built from this repository, or breaks this policy, open an issue on GitHub or write to SignPath Foundation through signpath.org. The team will help with any investigation.