From c6296366e514f40c5780d10dff855bc9d332cfb2 Mon Sep 17 00:00:00 2001 From: ManuelStaggl <17688572+ManuelStaggl@users.noreply.github.com> Date: Wed, 11 Nov 2026 19:06:47 +0100 Subject: [PATCH] docs: add the code signing policy and name the private reporting channel The policy the SignPath Foundation asks for: what is signed, the team roles, the privacy statement and how to uninstall. SECURITY.md still said the repository was private. Co-Authored-By: Claude Fable 5.2 --- README.md | 6 ++++ SECURITY.md | 7 ++--- docs/code-signing-policy.md | 58 +++++++++++++++++++++++++++++++++++++ 3 files changed, 67 insertions(+), 4 deletions(-) create mode 100644 docs/code-signing-policy.md diff --git a/README.md b/README.md index ed407d6f..a783218e 100644 --- a/README.md +++ b/README.md @@ -117,6 +117,12 @@ See [SECURITY.md](SECURITY.md). PartBuddy has no account and no telemetry; it ta assistant you choose and, for updates, to GitHub. Every commit is scanned for secrets and personal data before it is created and again in CI ([ADR 0009](docs/adr/0009-privacy-guardrails.md)). +## Code signing policy + +Free code signing provided by [SignPath.io](https://about.signpath.io), certificate by +[SignPath Foundation](https://signpath.org). What is signed, who approves a signature and what the +program sends where: [code signing policy](docs/code-signing-policy.md). + ## Licence Copyright (C) 2026 ManuelStaggl and contributors. diff --git a/SECURITY.md b/SECURITY.md index 9eb38e2f..67075f04 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,10 +2,9 @@ ## Reporting a vulnerability -The repository is private; only invited collaborators can read it. Report vulnerabilities as an -issue with the label `type: security` and mark sensitive details as such. A public reporting channel -(security contact address or GitHub private vulnerability reporting) is set up before the first -public release. +Report a vulnerability in private through +[GitHub's private vulnerability reporting](https://github.com/PartBuddy/partbuddy/security/advisories/new), +not as a public issue. Include the affected version, the steps to reproduce and the impact you expect. Remove personal data, API keys and model files from logs before attaching them. diff --git a/docs/code-signing-policy.md b/docs/code-signing-policy.md new file mode 100644 index 00000000..1f600908 --- /dev/null +++ b/docs/code-signing-policy.md @@ -0,0 +1,58 @@ +# Code signing policy + +Free code signing provided by [SignPath.io](https://about.signpath.io), certificate by +[SignPath Foundation](https://signpath.org). + +This applies to the Windows installer of PartBuddy (`PartBuddy-Setup-.exe`) and the +program files in it, from the first release signed this way. Earlier releases are unsigned. + +## What is signed + +Only what is built from this repository: the installer and PartBuddy's own executable. Each signed +file is built by a GitHub Actions workflow of this repository on a GitHub-hosted runner, from a +release tag on `main`; SignPath verifies that origin for every build. Libraries of other projects +that the installer contains (Electron and the npm packages listed in `THIRD-PARTY-NOTICES.txt`) +keep the signatures their own projects gave them, or none. + +SolidCraft, the assistants (Claude Code, ChatGPT, local model servers) and the slicers are not part +of PartBuddy and not in its installer; you install them yourself. + +## Team roles + +- Committers and reviewers: [ManuelStaggl](https://github.com/ManuelStaggl), the maintainer. Every + change reaches `main` through a pull request with the required checks; changes proposed by others, + including the dependency updates Renovate opens, are reviewed by the maintainer before they are + merged. +- Approvers: [the owners of the PartBuddy organization](https://github.com/orgs/PartBuddy/people?query=role%3Aowner). + Every signing request is approved by hand, once per release. + +All of them use multi-factor authentication on GitHub and on SignPath. + +## Privacy policy + +This program will not transfer any information to other networked systems unless specifically +requested by the user or the person installing or operating it. + +What it does on request: + +- **The assistant you choose.** What you write in the chat, and what the assistant reads of your + design to answer, goes to the assistant you set up: your own Claude or ChatGPT subscription, under + that provider's privacy policy, or a model server on your own computer. PartBuddy has no server of + its own in between. +- **Research.** When you allow the assistant to search the web for a part, its searches go through + that same provider. +- **Updates.** PartBuddy asks GitHub for the newest release of this repository and downloads it from + there. You can turn the check off in the settings. + +PartBuddy has no account, no telemetry and no crash reporting. Projects are folders on your +computer, and sign-ins are kept in the Windows credential store. + +## Uninstalling + +Windows Settings → Apps → PartBuddy → Uninstall, or the uninstaller in the installation folder. Your +projects and settings stay unless you delete them. + +## Reporting a problem + +If you think a signed file of PartBuddy violates this policy, see [SECURITY.md](../SECURITY.md), or +report it to SignPath Foundation as its [terms](https://signpath.org/terms) describe.