Tech riderRev. 4 Oct 2026

SignPath Foundation

Ch 096.9of 26 Code Signing Software

1Runs onAPI, Web
2CostsFree plan
3Supported targetsWindows executables and scripts, MSI, CAB, AppX/MSIX, NuGet, Java archives, Android packages, RPM, Debian packages, Office macros, XML, JSON, OCI container images, ClickOnce, and arbitrary files
4Certificate providedYes
5Cloud signingYes
6HSM key protectionYes
7Trusted timestampingYes
8CI/CD signingYes

8 lines stated Written from the maker's own pages: signpath.org

Visit site Alternatives

Overview

SignPath Foundation is ranked #9 of 26 in code signing software on Specifiction. It runs on API, Web. There is a free plan.

SignPath Foundation plans and pricing

All plans

Free OSS SignPath.io subscription Free For eligible open-source projects · project must be actively maintained and released · OSI-approved license · every release requires manual signing approval signpath.org · 4 Oct 2026

Compared on code signing software

Free plan: Yessignpath.org
Supported targets: Windows executables and scripts, MSI, CAB, AppX/MSIX, NuGet, Java archives, Android packages, RPM, Debian packages, Office macros, XML, JSON, OCI container images, ClickOnce, and arbitrary filessignpath.org
Certificate provided: Yessignpath.org
Cloud signing: Yessignpath.org
HSM key protection: Yessignpath.org
Trusted timestamping: Yessignpath.org
CI/CD signing: Yessignpath.org
Approval workflows: Yessignpath.org

Facts

Purpose: SignPath Foundation provides code-signing certificates to open-source projects to link published binaries to their repositories.signpath.org · 4 Oct 2026
Signing service: The Foundation provides certificates through SignPath.io, which performs the code signing.signpath.org · 4 Oct 2026
Key protection: SignPath says certificate private keys are securely generated and stored on a hardware security module.signpath.org · 4 Oct 2026
Build verification: For each release, SignPath.io verifies that signed files are automated builds from the project’s stated source repository.signpath.org · 4 Oct 2026
Build integrations: The documentation lists Jenkins, GitHub, GitLab, Azure DevOps, TeamCity, and AppVeyor as supported trusted build systems.docs.signpath.io · 4 Oct 2026
Approval requirement: Every release requires manual approval for signing.signpath.org · 4 Oct 2026
Eligibility: Eligible projects must be actively maintained, already released, use an OSI-approved open-source license, and contain no proprietary code or malware.signpath.org · 4 Oct 2026
Team security: All project team members must use multi-factor authentication for SignPath and source-code repository access.signpath.org · 4 Oct 2026
Signing roles: Projects must define author, reviewer, and approver responsibilities, and a team member must approve each signing request.signpath.org · 4 Oct 2026
Software restrictions: The Foundation does not sign software with features designed to identify or exploit vulnerabilities or bypass execution-environment security measures.signpath.org · 4 Oct 2026
Certificate identity: The Foundation certificate is issued to SignPath Foundation, which is therefore named as the software publisher.signpath.org · 4 Oct 2026
Acceptance discretion: The Foundation may accept or reject an application at its discretion and is under no obligation to accept a project.signpath.org · 4 Oct 2026
Operator: SignPath Foundation says it is currently operated by SignPath GmbH, the company behind SignPath.io.signpath.org · 4 Oct 2026