pulse/docs/CODE_SIGNING_POLICY.md

Code Signing Policy

Pulse publishes release artifacts from the public rcourtman/Pulse repository. This policy applies only to the open-source community artifacts built from that repository. Private Pulse Pro, Relay, Enterprise, and service infrastructure are outside the scope of the SignPath Foundation application and must not be submitted to the community signing project.

Signing service

Pulse was accepted into the SignPath Foundation open-source programme on 2026-08-06.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

The SignPath organization Pulse [OSS] and project Pulse are connected only to the public repository through SignPath's GitHub App and trusted build system. The production release certificate is still awaiting issuance (CSR PENDING), so the release-signing policy is not yet available for production releases.

Until the production certificate is active and the exact-commit, non-publishing proof run has passed, release notes must say when a Windows artifact is not Authenticode-signed. Detached checksums and Pulse release signatures remain mandatory and are not a substitute for Authenticode. The test-signing policy may be used to validate the integration, but its test certificate is untrusted and its output must never be published as a production release. The manual SignPath Test Signing Proof workflow is the only test-signing entrypoint: it is restricted to main, hard-codes the test policy, verifies the exact returned file set, and uploads only a non-production JSON evidence record after verification. It never uploads the test-signed binaries as a GitHub artifact or assembles a release candidate.

The canonical CI integration uses SignPath's GitHub trusted-build-system action. GitHub Actions uploads the three unsigned Windows agent executables as one immutable workflow artifact, submits it to SignPath, waits for approval and completion, downloads the signed result, and verifies every file before candidate assembly. A non-secret evidence artifact records the SignPath request URL, source SHA, signer identity, and signed-file SHA-256 values.

The artifact configuration accepts exactly these ZIP-root files and no others:

• pulse-agent-windows-amd64.exe
• pulse-agent-windows-arm64.exe
• pulse-agent-windows-386.exe

The repository-secret PFX path is an explicitly selected break-glass fallback. Normal stable publication and stable dry runs select signpath directly.

Build and release controls

• Release artifacts are built by GitHub Actions from an exact commit on the main branch.
• The release workflow records artifact digests and promotes the same immutable candidate without rebuilding it.
• Only binaries built from the public repository's source and build scripts may be submitted to the SignPath Foundation project.
• Third-party or private binaries must never be signed with the community project certificate.
• Every production signing request requires approval by an authorised project approver.
• Test-signed output must never enter a release candidate or publication path.
• Production signing must fail closed while the release certificate or signing policy is invalid.
• Release checksums and detached signatures are published alongside artifacts and verified independently after publication.

Project roles

• Committers and reviewers: repository collaborators listed by GitHub for rcourtman/Pulse.
• Approvers: the repository owner, rcourtman, and any future maintainer granted the SignPath Approver role by the repository owner.

All project members with repository or signing access must use multi-factor authentication. Signing access must be removed promptly when a maintainer no longer needs it.

User privacy and system changes

Pulse's data handling and opt-out controls are documented in the Privacy Policy. Installer behavior, service creation, privileges, and uninstallation are documented in the Installation Guide and Agent Security.

Security concerns involving a signed artifact should be reported using the private process in the repository's Security Policy.