Code Signing Policy

This policy covers the Windows installer of the SAPHO platform, published as sapho-aurora-Setup-vX.Y.Z.exe. It is the only artefact we sign. The source code lives at github.com/nipscernlab/aurora and the installers are published at github.com/nipscernlab/sapho/releases.

SAPHO is developed by NIPS-CERN, the Center for Instrumentation and Signal Processing, working from two laboratories: NIPS, at the Federal University of Juiz de Fora, in Brazil, and Route Salam, at CERN, in Switzerland.

Three roles take part in a release. They are separate on purpose: the person who writes a change is never the only person who lets it become a signed installer.

Approvers hold individual accounts with two-factor authentication. Accounts are never shared, and a signing request is never approved by the person who submitted it alone.

The chain is deliberately closed end to end, so that a signature means something more than "a file reached us":

1. A change is merged into main after review and a green build.
2. Release automation opens a release pull request; merging it creates the version tag.
3. A GitHub Actions workflow, running on GitHub-hosted Windows runners and defined in the public repository, checks out that exact commit, builds the installer and produces the update manifest.
4. The workflow submits the built installer to SignPath through the trusted build system integration. It cannot submit anything that was not built in that run.
5. An approver receives the request and approves or rejects it.
6. The signed installer is published to the distribution repository, together with the update manifest and the block map used for incremental updates.

No maintainer can sign an installer built on a personal machine: the signing credential exists only inside the continuous integration environment, and SignPath verifies that the request originates from the project's own workflow.

The certificate is provided by the SignPath Foundation, which issues free certificates to open source projects. This has a consequence worth stating plainly, because it surprises people who verify a download: the publisher shown by Windows is SignPath Foundation, not NIPS-CERN and not the university. That is expected and is not a sign of tampering.

Windows SmartScreen builds reputation over time, per certificate. The first signed releases may still show a warning; it fades as more copies are downloaded and run.

Anyone can check a downloaded installer without installing it. In PowerShell:

Get-AuthenticodeSignature .\sapho-aurora-Setup-v6.9.0.exe | Format-List

A valid copy reports the status as Valid and names the certificate subject. Right-clicking the file, then Properties and Digital Signatures, shows the same information.

Independently of the signature, every release also publishes a latest.yml carrying the SHA-512 of the installer. The application's own updater verifies that hash before running anything it downloaded.

Signing involves no data about the people who use SAPHO. What SignPath processes is the installer itself, the metadata of the build that produced it, such as repository, commit and workflow run, and the account details of the maintainers who submit and approve requests. Nothing about downloads or installations is reported back to us.

How this website handles visitors is covered separately in the Privacy Policy.

If a copy of the installer fails verification, or if you believe a signed release does not match its published source, do not open a public issue. Follow the disclosure process in the project's security policy, or write to [email protected].