From 25ba5fd63e284589e63e68de8159b133e803312c Mon Sep 17 00:00:00 2001 From: Richard Courtman Date: Thu, 6 Aug 2026 17:42:08 +0100 Subject: [PATCH] docs: publish SignPath policy links --- README.md | 1 + docs/CODE_SIGNING_POLICY.md | 7 ++++++- scripts/release_control/render_release_body.py | 2 ++ scripts/release_control/render_release_body_test.py | 4 ++++ 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 7954df1eb..a14463766 100644 --- a/README.md +++ b/README.md @@ -134,6 +134,7 @@ volume. See the [runtime-aligned capability reference](docs/PULSE_PRO.md) and - [Platform and agent guides](docs/README.md#platforms-and-agents) - [Pulse Intelligence](docs/AI.md) - [Security](SECURITY.md) and [privacy](docs/PRIVACY.md) +- [Code signing policy](docs/CODE_SIGNING_POLICY.md) - [Troubleshooting](docs/TROUBLESHOOTING.md) - [API reference](docs/API.md) and [architecture](ARCHITECTURE.md) diff --git a/docs/CODE_SIGNING_POLICY.md b/docs/CODE_SIGNING_POLICY.md index 0876f8d4d..3eb1c710e 100644 --- a/docs/CODE_SIGNING_POLICY.md +++ b/docs/CODE_SIGNING_POLICY.md @@ -10,7 +10,12 @@ community signing project. ## Signing service Pulse was accepted into the SignPath Foundation open-source programme on -2026-08-06. The SignPath organization `Pulse [OSS]` and project `Pulse` are +2026-08-06. + +> Free code signing provided by [SignPath.io](https://signpath.io/), certificate +> by [SignPath Foundation](https://signpath.org/). + +The SignPath organization `Pulse [OSS]` and project `Pulse` are connected only to the public repository through SignPath's GitHub App and trusted build system. The production release certificate is still awaiting issuance (`CSR PENDING`), so the `release-signing` policy is not yet available diff --git a/scripts/release_control/render_release_body.py b/scripts/release_control/render_release_body.py index 114c14b2b..d3edac6bc 100644 --- a/scripts/release_control/render_release_body.py +++ b/scripts/release_control/render_release_body.py @@ -197,6 +197,8 @@ def build_installation_section(version: str) -> str: "", "See the [Installation Guide](https://github.com/rcourtman/Pulse#installation) for complete setup instructions.", "", + "Review the [Code signing policy](https://github.com/rcourtman/Pulse/blob/main/docs/CODE_SIGNING_POLICY.md) for release provenance, approval roles, and signing scope.", + "", "Paid Pulse Pro, Relay, and eligible legacy customers: public GitHub release assets and the public `rcourtman/pulse` Docker image are community builds. They do not include the private Pulse Pro runtime hooks. Use https://pulserelay.pro/download.html with your activation key to get the private Pulse Pro Docker image or Linux/LXC archive.", ] ) diff --git a/scripts/release_control/render_release_body_test.py b/scripts/release_control/render_release_body_test.py index f27b2a41a..a3b9a7cb2 100644 --- a/scripts/release_control/render_release_body_test.py +++ b/scripts/release_control/render_release_body_test.py @@ -110,6 +110,10 @@ Old metadata section. self.assertEqual(body.count("## Installation"), 1) self.assertEqual(body.count("## Promotion Metadata"), 1) self.assertIn("docker pull rcourtman/pulse:6.0.0-rc.2", body) + self.assertIn( + "[Code signing policy](https://github.com/rcourtman/Pulse/blob/main/docs/CODE_SIGNING_POLICY.md)", + body, + ) self.assertIn( "public GitHub release assets and the public `rcourtman/pulse` Docker image are community builds", body,