Code signing policy
Current release signing, the proposed SignPath Foundation workflow, and the people responsible for approving KeyValet releases.
Updated: 14 October 2026. KeyValet is maintained by Simvito Limited and released under Apache-2.0.
Current status
We are preparing an application for free Windows code signing through SignPath Foundation. Approval has not been granted and SignPath signing is not enabled. Current Windows preview packages are unsigned.
If approved, free code signing will be provided by SignPath.io, with a certificate issued to SignPath Foundation. This statement describes the proposed service, not an existing endorsement. The Foundation's conditions apply to that service.
macOS release packages use the Simvito Limited Developer ID and Apple notarization. Linux release archives have published SHA256 checksums. Checksums verify file integrity; they do not replace a trusted publisher signature. The download page labels the status of each platform.
Signing team
The initial project maintainer is Guang, GitHub @hhstuhacker. The current project has one maintainer; these roles do not imply three independent people.
| Role | Member | Responsibility |
|---|---|---|
| Authors / committers | Guang (@hhstuhacker) | Maintain the project source and build workflows. |
| Reviewers | Guang (@hhstuhacker) | Review changes from external contributors before inclusion. |
| Release approvers | Guang (@hhstuhacker), for Simvito Limited | Review the source, validation and artifacts, then explicitly approve each signing request. |
These are the intended SignPath roles. Before signing is activated, the corresponding GitHub and SignPath accounts must have multi-factor authentication enabled and their permissions must be verified. Signing-team membership changes will be reflected here. See the project's governance.
Proposed Windows signing process
- Build from the public KeyValet source using the project's automated build workflow and locked dependencies.
- Verify the selected source revision, package contents, product name/version metadata, and relevant checks before requesting a signature.
- Require a release approver's explicit approval for each production signing request. The signing service retains control of the private signing key.
- Verify the returned signatures and the intended signing identity, publish artifact checksums, and label the resulting package's signing status.
Current Windows process authentication expects the existing Simvito Limited signing identity. A Foundation certificate is not a drop-in replacement. Adapting the release process and installed-process identity checks requires separate validation; signing approval alone does not enable Windows remote approval. The preview does not bypass the relay's publisher check.
The currently downloadable unsigned Windows preview was built locally on a native Windows/MSVC test machine. Its corresponding source snapshot and checksum are published alongside it. It is not presented as a SignPath-signed or CI-attested artifact.
Privacy and reporting
Software data flows, optional network services and provider policies are described in our Privacy policy. Credential values and device private keys are not included in distributed packages or signing submissions.
For questions about this policy, contact support@simvito.com. For a suspected vulnerability, use the project's private vulnerability reporting and avoid posting secrets in a public issue.