Code signing policy

How official WOR Host binaries are built, signed and verified.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

The certificate is issued to SignPath Foundation, so that is the publisher Windows shows for wor.exe. It does not mean the file came from anywhere other than this project.

Team roles

Committers and reviewers: Worapong Sriwichian
Approvers: Worapong Sriwichian

Only an approver can authorise a release for signing, and every release is approved manually. All team members use multi-factor authentication on both their SignPath and GitHub accounts.

How official releases are built

Official WOR Host releases are built by a GitHub Actions workflow in the project repository, on GitHub-hosted runners, from the tagged source commit. The Windows binary is submitted for signing directly from that workflow, and SignPath independently verifies with GitHub that the artifact came from that build before signing it. Binaries built anywhere else are never signed.

Releases are published at wor.worapong.com/download and on GitHub.

Third-party components

WOR Host is written in Go and depends on the Go standard library only. It has no third-party runtime dependencies, so no third-party code is included in the signed binary. Build-time tooling is limited to the Go toolchain and go-winres, which embeds the Windows version resource.

At runtime WOR Host invokes external programs that are already installed on the host — nginx or Apache, PM2, systemd, PHP-FPM, git, certbot and database client tools. These are neither bundled nor distributed with WOR Host and are not covered by this signature.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Uninstalling

wor reset removes everything WOR Host created — its PM2 processes, systemd units, generated host configs, hosts-file entries, and the workspace folders. Afterwards, delete the binary itself (/usr/local/bin/wor on Linux and macOS, or wherever wor.exe was placed on Windows) and the ~/.wor configuration directory.

Verifying a download

On Windows you can confirm the signature yourself:

Get-AuthenticodeSignature .\wor.exe | Format-List Status, SignerCertificate

A valid result reports Status: Valid with SignPath Foundation as the signer.