diff --git a/README.en.md b/README.en.md index 60c5d774..4d48b450 100644 --- a/README.en.md +++ b/README.en.md @@ -1,6 +1,6 @@ # Metasequoia IME for Windows -[中文 README](README.md) · [Website](https://msime.app) · [Docs](https://msime.app/docs/) · [Privacy](PRIVACY.md) +[中文 README](README.md) · [Website](https://msime.app) · [Docs](https://msime.app/docs/) · [Privacy](PRIVACY.md) · [Code signing policy](docs/code-signing-policy.md) [![CI](https://img.shields.io/github/actions/workflow/status/metasequoiaime/MSIME-Windows/ci.yml?branch=develop&label=CI)](https://github.com/metasequoiaime/MSIME-Windows/actions/workflows/ci.yml) @@ -52,6 +52,12 @@ There is no telemetry, analytics or crash reporting of any kind. Note that most issues, documentation and code comments are in Chinese. English pull requests and issues are welcome. +## Code signing policy + +Free code signing provided by [SignPath.io](https://about.signpath.io/), certificate by [SignPath Foundation](https://signpath.org/). + +What is signed, who the committers, reviewers and approvers are, the build and release process and the current status are in the [code signing policy](docs/code-signing-policy.md). The privacy policy is [PRIVACY.md](PRIVACY.md). + ## Licence GPL-3.0. See [LICENSE](LICENSE) and [THIRD_PARTY_NOTICES.txt](THIRD_PARTY_NOTICES.txt). diff --git a/README.md b/README.md index 59f1b1d2..0623fbf0 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # 水杉输入法 -[官网](https://msime.app) · [用户文档](https://msime.app/docs/) · [隐私说明](PRIVACY.md) · [English README](README.en.md) +[官网](https://msime.app) · [用户文档](https://msime.app/docs/) · [隐私说明](PRIVACY.md) · [代码签名策略 / Code signing policy](docs/code-signing-policy.md) · [English README](README.en.md) [![CI](https://img.shields.io/github/actions/workflow/status/metasequoiaime/MSIME-Windows/ci.yml?branch=develop&label=CI)](https://github.com/metasequoiaime/MSIME-Windows/actions/workflows/ci.yml) @@ -338,6 +338,12 @@ Server 启动时会同时启动 Watchdog。服务意外退出后，Watchdog 会 +## 代码签名策略 + +Free code signing provided by [SignPath.io](https://about.signpath.io/), certificate by [SignPath Foundation](https://signpath.org/). + +签名范围、团队角色（Committers / Reviewers / Approvers）、构建与发布流程以及当前状态见 [Code signing policy](docs/code-signing-policy.md)，隐私说明见 [PRIVACY.md](PRIVACY.md)。 + ## 开源协议 GPL-3.0。 diff --git a/docs/code-signing-policy.md b/docs/code-signing-policy.md new file mode 100644 index 00000000..dc2316ef --- /dev/null +++ b/docs/code-signing-policy.md @@ -0,0 +1,49 @@ +# Code signing policy + +Free code signing provided by [SignPath.io](https://about.signpath.io/), certificate by [SignPath Foundation](https://signpath.org/). + +**Current status.** The application to the SignPath Foundation open source program is under review, and no release has been signed through SignPath yet. Releases up to and including v0.9.3 were built on a maintainer's machine and signed there with the project's Certum Open Source Developer certificate (`CN=Open Source Developer LU FAN`) through SimplySign, using `installer/package-simplysign.ps1`. Once the application is approved, releases signed with the SignPath Foundation certificate will be built and signed only by the CI process described below, never on a local machine. + +## What gets signed + +Only the project's own binaries, built from source in this repository: + +- the Server (`MetasequoiaImeServer.exe`) and the helper executables shipped with it; +- the TSF text service DLLs (`MetasequoiaImeTsf.dll`, x64 and Win32); +- the installer `MetasequoiaIME_Setup_v.exe`. + +Third-party binaries are not signed with the project's certificate. + +## Source repository + +, licensed under GPL-3.0. The default branch is `develop`; `main` is the release branch. + +## Team roles + +| Role | Members | What the role may do | +| --- | --- | --- | +| Committers and reviewers | [fanlusky](https://github.com/fanlusky), [houko](https://github.com/houko), [jsfaint](https://github.com/jsfaint), [linyanm](https://github.com/linyanm), [Neptrue-Lin](https://github.com/Neptrue-Lin) | Push branches and merge pull requests into `develop` | +| Approvers | [fanlusky](https://github.com/fanlusky), [houko](https://github.com/houko) | Promote `develop` to `main`, which is what releases a signed build; approve signing requests | + +Approvers are the members of the `@metasequoiaime/maintainers` team, which owns the release-critical paths in [`.github/CODEOWNERS`](../.github/CODEOWNERS): the workflows, `installer/`, `scripts/`, `product-lock.json` and `version.txt`. The organization account `metasequoiaime-dev` is used only by the release automation and is not a person; it holds no role above. How roles are granted is described in the organization's [GOVERNANCE.md](https://github.com/metasequoiaime/.github/blob/main/GOVERNANCE.md). + +Contributors without write access can still propose changes through pull requests. Their changes are reviewed and merged by a committer before they can reach a release. + +## Build and release process + +This is the process every SignPath-signed release goes through. + +1. Every change lands in `develop` through a pull request. Direct pushes and force pushes to `develop` and `main` are blocked by a branch ruleset, and the pull request must pass the required CI checks (Windows x64 and Win32 builds, Server, GUI framework, settings page, product inputs, package contents, workflow validation and dependency review). Repository admins can bypass the ruleset only when merging a pull request, not by pushing directly. CodeQL scans the default branch daily. +2. An approver promotes `develop` to `main`. Feature branches cannot target `main` directly. +3. The [release workflow](../.github/workflows/release.yml) runs in GitHub Actions: release-please opens and tests the release pull request, merges it, creates a draft release, then builds every component from source at that commit. +4. The workflow refuses to build a commit that is not in the history of `main`, submits the payload binaries and the installer for signing, attaches a [build provenance attestation](https://docs.github.com/actions/security-for-github-actions/using-artifact-attestations) to the installer, and publishes the release with the installer's SHA256. + +Dictionaries are not built in CI. They are downloaded from the release pinned in [`product-lock.json`](../product-lock.json) and verified against the SHA256 recorded there. See [product-release.md](product-release.md) for the full release design. + +## Privacy policy + +Some features of the program send data over the network, and cloud candidates are on by default. What each feature sends, its default, and how to turn it off are documented in [PRIVACY.md](../PRIVACY.md). + +## Reporting a problem + +To report a signed binary that you believe was not built by this process, or any other security issue, see the organization's [security policy](https://github.com/metasequoiaime/.github/blob/main/SECURITY.md). diff --git a/scripts/ci/publish-release.sh b/scripts/ci/publish-release.sh index 95689cd5..d3a8c347 100755 --- a/scripts/ci/publish-release.sh +++ b/scripts/ci/publish-release.sh @@ -51,6 +51,7 @@ gh release view "$release_tag" --repo "$GH_REPO" --json body --jq .body > notes. printf '| SHA256 | `%s` |\n' "$ASSET_SHA256" printf '| Dictionaries | `%s` |\n' "$DICTIONARY_TAG" printf '| Build inputs | `product-manifest.json` (attached and installed) |\n' + printf '\n[Code signing policy](https://github.com/%s/blob/develop/docs/code-signing-policy.md)\n' "$GH_REPO" if [[ "$SIGNING_ENABLED" != true ]]; then printf '\nThis build is **unsigned**. Windows warns on launch, and `uiAccess` does not take effect, so the candidate window cannot float over elevated applications.\n' fi