Skip to content
SPECIFICTION
Get listed

SignPath Foundation

signpath.org

Free plan WebAPI
Visit signpath.org
Spec score 7.3 #20 of 28 in Code Signing Software

What it is

SignPath Foundation provides code-signing certificates to eligible open-source projects, with signing carried out through SignPath.io. For each release, SignPath.io checks that signed files are automated builds from the project’s stated source repository. Certificate private keys are generated and stored on a hardware security module. Each signing request requires a team member’s approval, and every release requires manual approval. Projects must assign author, reviewer, and approver responsibilities, while all team members must use multi-factor authentication for SignPath and repository access. Eligibility requires an actively maintained project with an existing release, an OSI-approved open-source license, and no proprietary code or malware. Supported build systems include Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor. Supported targets span Windows executables and scripts, MSI, CAB, AppX/MSIX, NuGet, Java archives, Android packages, RPM and Debian packages, Office macros, XML, JSON, OCI container images, ClickOnce, and other files. The free plan is free for eligible projects. Its certificate identifies SignPath Foundation as publisher, and the Foundation may decline applications.

Spec sheet

Purpose
SignPath Foundation provides code-signing certificates to open-source projects to link published binaries to their repositories.Read 4 Oct 2026 · signpath.org
Headquarters
Vienna, AustriaRead 28 Sep 2026 · signpath.org
Acceptance discretion
The Foundation may accept or reject an application at its discretion and is under no obligation to accept a project.Read 4 Oct 2026 · signpath.org
Approval requirement
Every release requires manual approval for signing.Read 4 Oct 2026 · signpath.org
Build integrations
The documentation lists Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor as supported trusted build systems.Read 4 Oct 2026 · docs.signpath.io
Build verification
For each release, SignPath.io verifies that signed files are automated builds from the project’s stated source repository.Read 4 Oct 2026 · signpath.org
Certificate identity
The Foundation certificate is issued to SignPath Foundation, which is therefore named as the software publisher.Read 4 Oct 2026 · signpath.org
Eligibility
Eligible projects must be actively maintained, already released, use an OSI-approved open-source license, and contain no proprietary code or malware.Read 4 Oct 2026 · signpath.org
Key protection
SignPath says certificate private keys are securely generated and stored on a hardware security module.Read 4 Oct 2026 · signpath.org
Operator
SignPath Foundation says it is currently operated by SignPath GmbH, the company behind SignPath.io.Read 4 Oct 2026 · signpath.org
Signing roles
Projects must define author, reviewer, and approver responsibilities, and a team member must approve each signing request.Read 4 Oct 2026 · signpath.org
Signing service
The Foundation provides certificates through SignPath.io, which performs the code signing.Read 4 Oct 2026 · signpath.org
Software restrictions
The Foundation does not sign software with features designed to identify or exploit vulnerabilities or bypass execution-environment security measures.Read 4 Oct 2026 · signpath.org
Team security
All project team members must use multi-factor authentication for SignPath and source-code repository access.Read 4 Oct 2026 · signpath.org

Plans and prices

Free OSS SignPath.io subscription Free For eligible open-source projects · project must be actively maintained and released · OSI-approved license · every release requires manual signing approval Read 4 Oct 2026 · signpath.org

Every SignPath Foundation plan and price →

Strong points and limits

Strong points

  • Private keys are protected by a hardware security module
  • Verifies signed files are automated repository builds
  • Supports multiple trusted build systems
  • Supports OCI container images and many package types

Limits

  • Every release requires manual signing approval
  • Project members must use multi-factor authentication
  • The certificate names SignPath Foundation as publisher
  • Applications may be declined

Who it suits

It suits qualifying open-source projects that need signed releases and can meet the manual approval, role, and multi-factor authentication requirements. Projects should also be comfortable with SignPath Foundation appearing as the software publisher.

Verdict

SignPath Foundation offers signing for eligible open-source releases with build verification and protected certificate keys. Manual approvals and strict eligibility requirements are central parts of the service.

Where Specifiction places it

Alternatives to SignPath FoundationAll alternatives →