docs: prepare SignPath application

Author: DiscoverBox

.github/workflows/release.yml

@@ -65,6 +65,14 @@ jobs:
 
             - macOS: Apple Silicon DMG
             - Windows: NSIS EXE / MSI
+
+            ## Code signing policy
+
+            GitBoost is applying for the SignPath Foundation open-source code-signing program. Treat an artifact as signed only when its Authenticode signature verifies successfully.
+
+            Free code signing provided by SignPath.io, certificate by SignPath Foundation.
+
+            See the [Code signing policy](https://github.com/DiscoverBox/gitboost/blob/main/CODE_SIGNING_POLICY.md).
           releaseDraft: true
           prerelease: false
           args: --target ${{ matrix.target }}

CODE_SIGNING_POLICY.md

@@ -0,0 +1,52 @@
+# Code signing policy
+
+Status: application to SignPath Foundation pending.
+
+GitBoost is applying for the SignPath Foundation open-source code-signing program. Until onboarding is complete, Windows downloads remain unsigned unless their Authenticode signature verifies successfully.
+
+Free code signing provided by SignPath.io, certificate by SignPath Foundation.
+
+## Signing scope
+
+This policy covers official Windows artifacts published from the [GitBoost repository](https://github.com/DiscoverBox/gitboost):
+
+- the x64 NSIS installer (`.exe`);
+- the x64 MSI installer (`.msi`), when published;
+- the project-owned `GitBoost.exe` included in those installers.
+
+macOS artifacts are outside this Authenticode policy. Third-party components are kept under their upstream licenses and signatures and are not signed as GitBoost-owned code.
+
+Historical releases may be unsigned. A release must not be described as signed unless Windows reports a valid Authenticode signature for the downloaded artifact.
+
+## Team roles
+
+- Authors, committers, and reviewers: [DiscoverBox organization members](https://github.com/orgs/DiscoverBox/people). Trusted members may commit project-owned source and build scripts; external contributions require maintainer review before merge.
+- Signing approvers: [DiscoverBox organization owners](https://github.com/orgs/DiscoverBox/people?query=role%3Aowner).
+
+All maintainers and signing approvers must use multi-factor authentication for GitHub and SignPath. Every release signing request requires manual approval by a signing approver.
+
+## Trusted source, build, and release process
+
+1. The only trusted source is a version tag in the public `DiscoverBox/gitboost` repository.
+2. The version-controlled [GitHub Actions release workflow](https://github.com/DiscoverBox/gitboost/blob/main/.github/workflows/release.yml) runs tests and builds Windows artifacts from that tagged commit on GitHub-hosted runners.
+3. Product metadata must identify the application as `GitBoost`, and the artifact version must match the release tag and the version in `package.json`.
+4. After SignPath onboarding, only artifacts produced by that workflow may be submitted through the configured SignPath signing policy. Each request must remain traceable to its commit, tag, workflow run, and artifact.
+5. Signed artifacts are published on [GitHub Releases](https://github.com/DiscoverBox/gitboost/releases). Signing credentials and private keys must never be committed to the repository.
+
+## Privacy policy
+
+GitBoost does not contain analytics or advertising SDKs, does not create user accounts, and does not upload settings, routes, health history, diagnostic reports, or Git usage logs to DiscoverBox. Application data is stored locally on the user's device.
+
+GitBoost makes the following network requests to provide its requested functionality:
+
+- It retrieves the public encrypted system-node catalog from configured CDN mirrors at startup and periodically while the application is running.
+- It performs limited HTTPS health probes against configured acceleration nodes. Background health checks follow the interval selected by the user and can be disabled in Settings.
+- When acceleration is enabled, Git HTTPS reads for the user's configured public repositories are routed through the selected third-party acceleration node. That service can observe the user's IP address, the public repository path, and transferred content.
+- When the user starts a file download, GitBoost probes the selected acceleration URL and opens it in the user's default browser.
+- Project and documentation links open their public GitHub destinations in the user's default browser.
+
+These services receive normal connection metadata according to their own privacy policies. GitBoost is intended only for public GitHub repositories and must not be used for private repositories, credentials, tokens, or other sensitive content.
+
+## Verification and incident response
+
+Users should download GitBoost only from the project's GitHub Releases page and verify that any release advertised as signed has a valid Authenticode signature. If the repository, build workflow, or signing account is suspected to be compromised, maintainers will stop signing and publishing affected artifacts, investigate the incident, and work with SignPath Foundation on certificate revocation when required.

README.md

@@ -74,6 +74,14 @@ GitBoost 不提供代理服务。它只检测第三方线路，并通过独立
 >
 > macOS 包未使用 Apple Developer ID 证书签名，也未经过 Apple 公证。Windows 包未配置发布者代码签名，可能显示“发布者未知”或触发 SmartScreen。请只从本项目的 [GitHub Releases](https://github.com/DiscoverBox/gitboost/releases) 下载。
 
+### Code signing policy
+
+GitBoost 正在申请 SignPath Foundation 的开源代码签名服务。申请和接入完成前，Windows 安装包仍按未签名软件处理；只有 Windows 显示 Authenticode 签名有效的发布包才可视为已签名。
+
+Free code signing provided by SignPath.io, certificate by SignPath Foundation.
+
+签名范围、负责人、可验证构建流程和隐私说明见 [Code signing policy](CODE_SIGNING_POLICY.md)。
+
 ## 用户手册
 
 安装、首次启用、线路确认、环境诊断和恢复配置见 [GitBoost 用户手册](docs/USER_GUIDE.md)。