From 6fb594a75cc6eab097dcdbc45053671b1102c574 Mon Sep 17 00:00:00 2001 From: forkless Date: Mon, 1 Jun 2026 12:24:33 +0200 Subject: [PATCH] Add code signing policy --- CODE_SIGNING_POLICY.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 CODE_SIGNING_POLICY.md diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md new file mode 100644 index 0000000..e6ef5bf --- /dev/null +++ b/CODE_SIGNING_POLICY.md @@ -0,0 +1,37 @@ +# Code Signing Policy + +NotAlterra uses automated, auditable pipelines to ensure every release +artifact is traceable to its source. + +## Build & Signing Process + +All release binaries are built from this repository by GitHub Actions on +tag push. The CI workflow runs on `ubuntu-latest`, installs the +required toolchain via `dtolnay/rust-toolchain@stable`, and produces +deterministic artifacts using a locked `Cargo.lock` and pinned +dependency versions. + +## AI Usage Disclosure + +This project uses agentic AI coding tools (e.g., DeepSeek TUI, +GitHub Copilot) as assistive aides for code generation and review. AI +tools operate under human supervision only: + +- Every code change is reviewed and committed by a human maintainer. +- AI-generated code is identified in commit history — no attempt is made + to obscure or anonymize the source. +- All contributions pass the same lint and verification gates as any + human-authored change. + +## Integrity + +AI tools do not have direct write access to the release pipeline or the +repository's tag namespace. Builds are triggered exclusively by signed +Git tags, which can only be created by a human maintainer with access to +the project's GPG key. + +## Signing + +Only binaries produced by the official CI runner from the `master` +branch will be submitted to SignPath for signing. Manual or off-CI +builds are never shipped as signed releases.