mirror of
https://github.com/forkless/NotAlterra.git
synced 2026-08-24 19:22:37 +02:00
38 lines
1.3 KiB
Markdown
38 lines
1.3 KiB
Markdown
# Code Signing Policy
|
|
|
|
NotAlterra uses automated, auditable pipelines to ensure every release
|
|
artifact is traceable to its source.
|
|
|
|
## Build & Signing Process
|
|
|
|
All release binaries are built from this repository by GitHub Actions on
|
|
tag push. The CI workflow runs on `ubuntu-latest`, installs the
|
|
required toolchain via `dtolnay/rust-toolchain@stable`, and produces
|
|
deterministic artifacts using a locked `Cargo.lock` and pinned
|
|
dependency versions.
|
|
|
|
## AI Usage Disclosure
|
|
|
|
This project uses agentic AI coding tools (e.g., DeepSeek TUI,
|
|
GitHub Copilot) as assistive aides for code generation and review. AI
|
|
tools operate under human supervision only:
|
|
|
|
- Every code change is reviewed and committed by a human maintainer.
|
|
- AI-generated code is identified in commit history — no attempt is made
|
|
to obscure or anonymize the source.
|
|
- All contributions pass the same lint and verification gates as any
|
|
human-authored change.
|
|
|
|
## Integrity
|
|
|
|
AI tools do not have direct write access to the release pipeline or the
|
|
repository's tag namespace. Builds are triggered exclusively by signed
|
|
Git tags, which can only be created by a human maintainer with access to
|
|
the project's GPG key.
|
|
|
|
## Signing
|
|
|
|
Only binaries produced by the official CI runner from the `master`
|
|
branch will be submitted to SignPath for signing. Manual or off-CI
|
|
builds are never shipped as signed releases.
|