Loadstar

Code signing policy

Who can change Loadstar’s code, who can authorize a signature, and how a released artifact is produced. This page exists because a signature is only worth the process behind it — it proves an artifact came from this pipeline, not that the pipeline is careful.

Project

Roles

Loadstar is a single-maintainer project. This section says so plainly rather than describing a separation of duties that does not exist.

Role Held by Responsibility
Author R3N Writes and commits code
Reviewer R3N Reviews changes before they reach main
Approver R3N Authorizes signing of a release artifact

One person currently holds all three roles, so the integrity guarantees rest on the automated controls below rather than on review by a second party. If a maintainer joins, Reviewer and Approver move to them and this table changes in the same commit.

Controls

Signing status

Loadstar releases are not currently signed, and the README says so where users will meet the Windows warning.

An application to the SignPath Foundation, which provides free code signing to open-source projects, is pending. If accepted, signing will be performed by SignPath.io using a certificate issued to the SignPath Foundation, with the private key held in SignPath’s HSM and never in this project’s possession. The Approver above authorizes each signed release. This page and the README will be updated at that point.

Reporting a problem

Open an issue at https://github.com/eugenebednik/loadstar/issues. If you believe you have found a security or supply-chain problem, say so in the title and it will be handled ahead of feature work.