Free Code Signing for Open Source: Our SignPath Application 🔏

Anyone who installs our game on Windows may know the moment: "Windows protected your PC" — SmartScreen warns about an "unknown publisher," and you have to click "More info → Run anyway" first. That's not a virus; it's simply because our installers aren't signed yet. We want that warning gone — without having to buy an expensive certificate.

The problem with code-signing certificates. A Windows publisher certificate (OV or EV) costs money every year, often tied to company verification and a hardware token. For a commercial studio, one line item among many. For an open-source family project, a real hurdle — and somehow the wrong one, too: we are transparent, the entire source code is public.

The solution: the SignPath Foundation. SignPath grants code signing for free to open-source projects. That's exactly what we've now applied for. Nothing is approved yet — the review is ongoing — but the preparation was instructive enough to share. If you want to sign your own OSS project, here's what we had to do.

1. The prerequisites. A public repository, a recognized OSI license (AGPL-3.0 in our case), published releases with visibly active development and documentation — and, non-negotiable: two-factor authentication on the GitHub account. A bit of project reputation helps, too: a website, videos, a few stars.

2. The code-signing policy (the most important part). SignPath wants to know exactly how signing happens in your project. So we added a CODE_SIGNING.md to the repo that spells out: which repository is the official one, which artifacts get signed, that only the CI release workflow signs (never a local build on someone's laptop), who approves releases — and a link to the privacy policy. This point is the heart of the application.

3. The download page must mention SignPath. The form asks for a "download URL" that references SignPath. We rewrote the security notice in our README for this. Honesty mattered to us: as long as nothing is signed yet, it says explicitly that signing is currently being set up — no promise that isn't true yet.

4. A real privacy policy. If your software processes data — crash reports and player accounts, in our case — you need an actual GDPR privacy policy, not a website-builder placeholder.

5. Submit. Fill in the form (repo, homepage, download and privacy URL, a one-liner about the project, reputation, build system = GitHub Actions), tick the required boxes, send.

Now we wait: the review is manual, usually one to two weeks, possibly with follow-up questions. If it's approved, we'll wire the signing step into our CI pipeline — and then the SmartScreen warning disappears for everyone who downloads the game. As soon as we hear back, part 2 will follow with the concrete CI integration.

Wish us luck. 🤞