- Home
- Code Signing Software
- SignPath Foundation
SignPath Foundation
Vienna, Austria
What it is
SignPath Foundation provides code-signing certificates to eligible open-source projects, helping connect released binaries with their source repositories. SignPath.io carries out the signing and checks that each release consists of automated builds from the project's stated repository. Private certificate keys are generated and stored on a hardware security module. Each release needs manual approval, and projects must assign author, reviewer, and approver responsibilities, with a team member approving every request. Applicants must be actively maintained projects with an existing release, an OSI-approved open-source license, and no proprietary code or malware. Team members must use multi-factor authentication for SignPath and repository access. Supported trusted build systems include Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor. Supported targets range from Windows files and Android packages to Java archives, Linux packages, Office macros, and OCI container images. The free subscription is for eligible open-source projects. The resulting certificate names SignPath Foundation as publisher, and the Foundation may decline an application. SignPath Foundation says it is operated by SignPath GmbH.
For and against
For
- Free subscription for eligible open-source projects
- Private keys kept on a hardware security module
- Verifies signed files as automated repository builds
- Supports several trusted build systems
Against
- Every release requires manual approval
- Eligibility excludes proprietary code and malware
- Foundation may reject applications
- Certificate names SignPath Foundation as publisher
The verdict
SignPath Foundation offers free code-signing certificates to projects that meet its eligibility and team-security requirements. Manual approval is required for every release, and the certificate identifies the Foundation as publisher.
Who it suits
This service suits actively maintained open-source projects with an existing release and an OSI-approved license. Teams must be able to use multi-factor authentication and assign signing approval roles.
Plans and prices
Free OSS SignPath.io subscription
For eligible open-source projects · project must be actively maintained and released · OSI-approved license · every release requires manual signing approval
Read 4 Oct 2026 · signpath.org
On the record
- Acceptance discretion
- The Foundation may accept or reject an application at its discretion and is under no obligation to accept a project.signpath.org · read 4 Oct 2026
- Approval requirement
- Every release requires manual approval for signing.signpath.org · read 4 Oct 2026
- Build integrations
- The documentation lists Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor as supported trusted build systems.docs.signpath.io · read 4 Oct 2026
- Build verification
- For each release, SignPath.io verifies that signed files are automated builds from the project’s stated source repository.signpath.org · read 4 Oct 2026
- Certificate identity
- The Foundation certificate is issued to SignPath Foundation, which is therefore named as the software publisher.signpath.org · read 4 Oct 2026
- Eligibility
- Eligible projects must be actively maintained, already released, use an OSI-approved open-source license, and contain no proprietary code or malware.signpath.org · read 4 Oct 2026
- Key protection
- SignPath says certificate private keys are securely generated and stored on a hardware security module.signpath.org · read 4 Oct 2026
- Operator
- SignPath Foundation says it is currently operated by SignPath GmbH, the company behind SignPath.io.signpath.org · read 4 Oct 2026
- Purpose
- SignPath Foundation provides code-signing certificates to open-source projects to link published binaries to their repositories.signpath.org · read 4 Oct 2026
- Signing roles
- Projects must define author, reviewer, and approver responsibilities, and a team member must approve each signing request.signpath.org · read 4 Oct 2026
- Signing service
- The Foundation provides certificates through SignPath.io, which performs the code signing.signpath.org · read 4 Oct 2026
- Software restrictions
- The Foundation does not sign software with features designed to identify or exploit vulnerabilities or bypass execution-environment security measures.signpath.org · read 4 Oct 2026
- Team security
- All project team members must use multi-factor authentication for SignPath and source-code repository access.signpath.org · read 4 Oct 2026
