Code signing policy
How the Windows releases of the OrbitSSH desktop client are built and signed, who approves a signature, and what happens if something goes wrong.
Status
OrbitSSH is applying to the SignPath Foundation open-source program. Once the application is approved, covered Windows release artifacts will use free code signing provided by SignPath.io, certificate by SignPath Foundation.
Until then, Windows installers are not Authenticode-signed and Windows SmartScreen may warn about an unknown publisher. We will not describe a release as signed before it actually is.
What gets signed
- The desktop client executable
orbitssh.exeand the Windows installerOrbitSSH_x.y.z_x64-setup.exe. - The uninstaller that the installer writes onto your computer is generated during installation and is not signed separately.
- Third-party binaries are not signed by us. They keep their own publishers' signatures.
Source and build provenance
- Official source repository: github.com/orbitssh/orbitssh (GPL-3.0).
- Signed release artifacts are built from that repository by GitHub Actions (the
sign-windows.ymlworkflow). Signing requests can only come from that workflow. - A maintainer must manually approve every release signing request on SignPath.
- Changes to the release workflow, this policy or signing permissions require maintainer review.
Automatic updates
In addition to Authenticode, every installer delivered through the in-app updater carries a separate update signature. The client refuses any update whose signature does not match the public key built into it. The private key for update signatures is kept by the maintainer offline and is never uploaded to GitHub or any build service.
Roles
OrbitSSH is currently maintained by an individual maintainer.
- Committer and reviewer: the OrbitSSH maintainer (GitHub organization orbitssh)
- Signing approver: the OrbitSSH maintainer
Contributions from other people are accepted through pull requests and are reviewed before merging.
Key protection and revocation
OrbitSSH maintainers never receive or store the SignPath Foundation private key. Signing is performed by SignPath.io under the approved project and signing policies.
If a signed artifact, the release workflow, a maintainer account or a signing request is suspected to be compromised, we stop signing and publishing, investigate, notify SignPath Foundation and request revocation where appropriate.
Privacy
See the OrbitSSH privacy policy.