Anyone who has installed SAPHO on Windows knows the blue screen. The system halts the installer, announces that it has protected the machine, and buries the button that lets you go ahead behind a discreet link. The warning never says the program is dangerous. It says the program has no identity: nothing in the file ties it back to the people who wrote it.
That has an end in sight. On 6 August 2026 the SignPath Foundation approved the group's application and created the organisation SAPHO [OSS] on its platform. From here SAPHO gets a certificate issued to the project, and the signing moves off anybody's machine and into the build pipeline.
SignPath began in 2017 inside RUBICON IT, a Viennese software house, out of a frustration its own developers lived with: code signing was brittle, manual and cut off from the rest of the build, treated as a final stamp before delivery rather than part of the engineering. In 2023 the platform became a company in its own right, SignPath GmbH, based on Gonzagagasse in central Vienna. Next to it sits the foundation, which gives open source projects, free of charge, the same service paying customers buy.
A code signing certificate is no luxury item, but it is not cheap either: the yearly subscription runs into the hundreds of dollars, and since the certificate authorities started requiring the private key to be kept in hardware, the token or security module goes on the bill as well. For the laboratory of a public university that is a recurring expense in foreign currency, one that has to be justified every year and usually loses the argument to something more pressing.
The foundation model differs in more than the price, though. Commercial certificates are issued to a person or a company, sit on a USB token and travel with whoever does the signing. Here it works the other way round: the certificate belongs to the project, the private key never leaves a hardware security module, and signing happens inside the build pipeline, bound to the repository that produced the binary. Whoever downloads the installer is not trusting a name. They are trusting a link between the published source and the file that just landed on their machine.
Getting here took a while, and nearly all of it was verification. The first message went out on 19 June, to Phillip Deng, and what followed were chained rounds of checking in which each side had to prove itself to the other. We had to adapt the site, the repository and the project itself so that authenticity could be verified in both directions: who signs, what the laboratory is and what SAPHO is all had to match what is published and open for anyone to check.
On our side that meant documents, published papers, evidence of the work at CERN, the tie to UFJF, and a list of things nobody normally has to prove in order to hand out a program. From the foundation came the questions it has to ask before lending out its name: who maintains SAPHO, how releases are published, what keeps the build from being diverted along the way. Nearly two months later the invitation arrived, accepted by Chrysthofer Arthur under his CERN address. In a few weeks the project will appear on the foundation's public list, at signpath.org/projects.
Over the coming weeks SAPHO/AURORA goes onto the machines at LABEL, the Electronics Laboratory at UFJF, and reaches the students, lecturers, researchers and enthusiasts who open the tool every day. SmartScreen will not clear it at once: publisher reputation builds up as signed binaries are downloaded, which is why the installers are also going to Microsoft for analysis, the shortest route to cutting that wait short.
SAPHO is written in the electronics laboratory of a Brazilian public university and runs on the computers of people who will never read its source. Until today, what held that relationship together was the word of whoever writes it. Now there is a way to put a signature in its place.