Distribution and signing

This page records where NetPace stands on distribution channels and code signing: which channels accept an unsigned build, why paid signing is deferred, what to do now, and what would reopen the decision. Stories for the distribution work are drafted from it. Last reviewed 18 October 2026.

Summary

Paid code signing is deferred until NetPace has a user base. Until then, NetPace ships through every channel that accepts an unsigned build, and adds the free trust measures.

• The decision. Ship to winget, Chocolatey, a NetPace Homebrew tap and apt/rpm unsigned, apart from the free GPG signing apt requires. Add build provenance and checksums. Revisit paid signing when a trigger below fires.
• Why. Package managers mostly install without the "downloaded from the internet" mark that drives OS warnings. The channels that do want signing also want a user base NetPace does not have yet. For a small project, signing would not remove the Windows warning anyway.
• What it rests on. SignPath Foundation (free Windows signing) declined NetPace because of its small user base. Azure Artifact Signing is open only to organisations in the UK, and the NetPace limited company has been closed. That leaves Apple (£79/year) and Certum (from €49/year) as the paid options.
• Dependency. Native AOT builds for macOS (#407) come first, whether or not signing follows.

Channels and what each requires

Channel	Unsigned build accepted?	User sees a warning?
dotnet tool / dnx (already shipped)	Yes	No
winget	Yes, unsigned portable .exe files are common there	Usually not; not confirmed whether winget always skips the mark
Chocolatey	Yes	No
NetPace Homebrew tap (formula)	Yes	No; the macOS Native AOT binary carries the minimal signature Apple silicon requires
apt / rpm	Needs a GPG-signed repository, which is free	No
Browser-downloaded release archives	Yes	Yes, as it already is for every Windows and macOS archive

Only users who download a release archive through a browser would see a difference from signing. Nothing changes for them by waiting, because those archives are unsigned today.

Why paid signing is deferred

1. Package managers mostly avoid the warnings signing removes. SmartScreen on Windows and Gatekeeper on macOS mostly trigger on files a browser marks as downloaded from the internet. The package managers in the table install without that mark.
2. The places that want signing also want a user base. Homebrew's official cask list requires signed and notarised software, but a CLI tool belongs in homebrew-core as a formula. homebrew-core has its own popularity bar, roughly 75 stars or 30 forks or watchers, and rejects low-profile projects. SignPath declined NetPace for the same reason. Paying Apple now would get NetPace into neither; more users would get it into both.
3. Signing would not remove the Windows warning for a small project. SmartScreen builds trust from download volume, and even EV certificates no longer skip that. A signed NetPace with few downloads would still show a warning, just with the publisher's name on it.
4. The cost is mostly ongoing work. Signing means certificates and keys stored as secrets and renewed each year, a notarisation step that can fail on Apple's side and hold up a release, and more release gates and docs/RELEASING.md to keep current.

The counter-argument. A first impression of "unidentified developer" may lose a few people who would have tried NetPace. That is small next to the reach of winget, Chocolatey, Homebrew and apt, and a short note in the user guide covers most of those users.

Work to do now

All free. Each is a candidate story.

• Native AOT builds for macOS: #407, the first dependency.
• winget: publish NetPace to the winget community repository.
• Chocolatey: publish NetPace to the Chocolatey community repository.
• Homebrew tap: a NetPace tap with a formula installing the macOS (and Linux) release binary.
• apt / rpm: build .deb and .rpm packages and publish them to a GPG-signed repository. Generate the signing key as part of this work, and choose hosting: GitHub Pages, or a hosted service with a free open-source tier such as Cloudsmith. Ubuntu PPAs are a poor fit, because Launchpad builds from source.
• Build provenance and checksums: attach build-provenance attestations and a checksums file to each release, so anyone can verify an archive was built by NetPace's release workflow from a given commit. It covers every archive on every platform, and needs nothing else first.
• User guide note: a short section in USER_GUIDE.md on what to do when macOS or Windows warns about a directly downloaded binary.

When to revisit

Trigger	Action	Cost
The user base has visibly grown: stars, downloads, package-manager installs	Reapply to SignPath Foundation for free Windows signing; listings on winget, Chocolatey and Homebrew strengthen the application	£0
NetPace wants into homebrew-core or the official cask list, or users report Gatekeeper friction	Join the Apple Developer Program; sign and notarise the macOS binaries	£79/year
SignPath still declines once NetPace has traction, and users complain about Windows warnings	Certum Open Source Code Signing, issued to an individual	From €49/year
A company is formed again	Azure Artifact Signing becomes the best Windows option	About US$120/year

Signing options researched

Kept for whenever a trigger fires.

• Apple Developer Program (macOS). The only route; individuals qualify.
  • Needs a Developer ID Application certificate (.p12) and an App Store Connect API key, both stored as CI secrets.
  • Sign with codesign --options runtime --timestamp, then notarise with xcrun notarytool submit --wait on the existing macOS runners.
  • A bare command-line binary cannot carry its notarisation ticket, so macOS checks online on first run.
  • The Native AOT build needs no extra entitlements. A non-AOT build would need permissions such as allow-jit.
• SignPath Foundation (Windows). Free signing for open-source projects, with a GitHub Actions integration.
  • Requires an OSI-approved licence, an automated build from the public repository, a code-signing policy on the project home page, and approval.
  • The certificate is issued in the Foundation's name.
• Certum Open Source Code Signing (Windows). A cloud certificate issued to an individual open-source developer, from €49/year.
  • Each signing is unlocked with a one-time code from a phone app, which fights unattended CI signing. An unofficial client, ssign, works around this.
• Azure Artifact Signing (Windows). About US$9.99/month and CI-native, but in the UK it is open only to organisations.
• OV certificates from a certificate authority (Windows). Usually over £100/year, with the key held on hardware. Not worth it given the options above.
• GPG (apt / rpm). Free. The same key signs both repository types.
• NuGet. nuget.org signs every package itself; author signing adds nothing worth paying for.