From b4683ddb59eaa02ac9f4966b7427c8b1125ba0bf Mon Sep 17 00:00:00 2001 From: James Maes Date: Sun, 11 Oct 2026 07:29:45 -0500 Subject: [PATCH] docs(exceptions): close EX-0002 for gclo gclo releases are Authenticode-signed through the shared workflow since v1.0.2-beta.3 (Azure Artifact Signing over OIDC, verified with signtool); the exception now covers only Windows apps that have not turned sign: true on. Relates to KofTwentyTwo/gclo#57 Co-Authored-By: Claude Fable 5.1 Signed-off-by: James Maes --- exceptions/register.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/exceptions/register.md b/exceptions/register.md index 0780ddc..5de5a6d 100644 --- a/exceptions/register.md +++ b/exceptions/register.md @@ -6,7 +6,7 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in | ID | Status | Requirements | Scope | Expires | | --- | --- | --- | --- | --- | | [EX-0001](#ex-0001) | Open | K22-REPO-20 (approval count), OSPS-QA-07.01 | All repositories | When a second maintainer joins; reviewed 2027-10-09 | -| [EX-0002](#ex-0002) | Open | K22-REL-05 (Authenticode signing of Windows binaries) | Windows desktop apps (gclo, AppKit samples, future apps) | When the Azure Trusted Signing identity is validated, at the latest 2027-04-09 | +| [EX-0002](#ex-0002) | Open (closed for gclo 2026-10-11) | K22-REL-05 (Authenticode signing of Windows binaries) | Windows desktop apps not yet on `sign: true` (AppKit samples, future apps) | When each app turns on `sign: true` in the shared release workflow, at the latest 2027-04-09 | | [EX-0003](#ex-0003) | Open | K22-DEP-02 (license allowlist) | gclo | Reviewed yearly, next on 2027-10-09 | | [EX-0004](#ex-0004) | Open | K22-CI-30, K22-REL-04 (shared release workflow) | gclo | When the shared reusable release workflow ships, at the latest 2027-04-09 | | [EX-0005](#ex-0005) | Open | K22-AI-10 (agents via PR only), K22-AI-11 (in part: unconfirmed pushes) | second-brain, nix, Praetor, Jellyfin | Reviewed yearly, next on 2027-10-10 | @@ -61,6 +61,13 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in EX-0004); releases before that have neither. - **Expires:** when the signing identity is validated and the shared release workflow signs Windows binaries; at the latest 2027-04-09. +- **Closed for gclo:** 2026-10-11. The signing identity (Azure Artifact Signing account + `kof22signing`, Public Trust profile, publisher "James Maes") is validated and the + shared workflow signs on `sign: true` (standards#28/#29): gclo v1.0.2-beta.3, + v1.1.0-beta.1 and v1.1.0 ship Setup.exe, Update.exe and every exe/dll + Authenticode-signed (SHA-256, RFC 3161), verified with `signtool verify /pa /all` by + gclo's `verify-signatures` job and by hand (289 files, 0 failures). The exception + stays open only for Windows apps that have not turned `sign: true` on yet. - **Owner:** the maintainer. ## EX-0003 -- 2.54.0