docs: update code signing and download verification documentation (#1470)#1479
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis pull request updates code signing and download verification documentation across English and Japanese resources. CODE_SIGNING_POLICY.md is comprehensively rewritten to define official distribution channels, platform-specific signing statuses, release integrity controls with SHA256SUMS.txt as canonical, and GitHub Artifact Attestations scope. Corresponding download verification guides are synchronized with new terminology and v1.8.1 availability conditions. README files are updated with formatting adjustments and new cross-references to policy and verification documentation. ChangesCode Signing Policy and Download Verification
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates project documentation to clearly communicate platform-specific signing status and guide users through verifying official downloads (checksums / attestations), addressing Issue #1470’s authenticity and distribution-channel clarity goals.
Changes:
- Reformats README feature/roadmap tables and adds links to the signing policy + download verification guide.
- Updates/expands
CODE_SIGNING_POLICY.mdwith official distribution locations, per-platform signing status, and verification guidance. - Updates the download verification guides (EN/JA) terminology and v1.8.1+ verification metadata wording.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds links to signing policy + verification guide; table formatting cleanup. |
| docs/README.ja.md | Updates Japanese docs to link to signing policy and verification guide; table formatting cleanup. |
| docs/download-verification.md | Adjusts checksum/attestation wording and section header terminology. |
| docs/download-verification.ja.md | Mirrors verification-guide wording updates in Japanese; adds stronger warning wording. |
| CODE_SIGNING_POLICY.md | Rewrites policy to reflect current signing status per platform and official distribution channels; links to verification guide. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/download-verification.md (1)
79-80:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate terminology to match the revised section name.
Line 80 still references "GitHub build provenance attestations" but the section was renamed to "GitHub Artifact Attestations" (line 52). Update for consistency.
📝 Proposed fix
Winget is an installation channel. It does not replace Authenticode signing, -SHA-256 checksums, or GitHub build provenance attestations. +SHA-256 checksums, or GitHub Artifact Attestations.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/download-verification.md` around lines 79 - 80, Update the terminology in the sentence that currently reads "GitHub build provenance attestations" to match the renamed section title "GitHub Artifact Attestations" so the line reads something like "GitHub Artifact Attestations"; locate the occurrence of the phrase "GitHub build provenance attestations" in the docs/download-verification.md content and replace it with "GitHub Artifact Attestations" to ensure consistency with the section header.
🧹 Nitpick comments (1)
CODE_SIGNING_POLICY.md (1)
34-35: ⚡ Quick winConsider aligning version reference with download verification guides.
The policy document references "v1.8.1-alpha.1" but the download verification guides use "v1.8.1". While "v1.8.1-alpha.1 and later" is technically more precise, consider using consistent version terminology across all documentation to avoid user confusion. Either update the download guides to specify "v1.8.1-alpha.1" or update this line to match "v1.8.1" for consistency.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CODE_SIGNING_POLICY.md` around lines 34 - 35, Update the version reference so documentation is consistent: change the string "v1.8.1-alpha.1" in the sentence starting with "SHA-256 checksums and GitHub Artifact Attestations are available starting with" to match the version used in the download verification guides (either replace with "v1.8.1" or update the download guides to use "v1.8.1-alpha.1"); ensure the chosen version is applied consistently across CODE_SIGNING_POLICY.md and the download verification guides.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CODE_SIGNING_POLICY.md`:
- Around line 93-94: The link in CODE_SIGNING_POLICY.md points to a nonexistent
anchor docs/download-verification.md#macos-signature-and-notarization; fix it by
either adding a heading with the exact anchor text
"macos-signature-and-notarization" to docs/download-verification.md (e.g., a
"macOS signature and notarization" section) or update the link in
CODE_SIGNING_POLICY.md to the correct existing heading in
docs/download-verification.md so the anchor resolves; reference the file
CODE_SIGNING_POLICY.md and the target document docs/download-verification.md
when making the change.
In `@docs/download-verification.ja.md`:
- Line 52: There is a duplicated word "この これは" in the Japanese docs sentence;
edit the sentence to remove the extra "この" so it reads "これは" (replace the exact
sequence "この これは" with "これは") to correct the typo in the document.
---
Outside diff comments:
In `@docs/download-verification.md`:
- Around line 79-80: Update the terminology in the sentence that currently reads
"GitHub build provenance attestations" to match the renamed section title
"GitHub Artifact Attestations" so the line reads something like "GitHub Artifact
Attestations"; locate the occurrence of the phrase "GitHub build provenance
attestations" in the docs/download-verification.md content and replace it with
"GitHub Artifact Attestations" to ensure consistency with the section header.
---
Nitpick comments:
In `@CODE_SIGNING_POLICY.md`:
- Around line 34-35: Update the version reference so documentation is
consistent: change the string "v1.8.1-alpha.1" in the sentence starting with
"SHA-256 checksums and GitHub Artifact Attestations are available starting with"
to match the version used in the download verification guides (either replace
with "v1.8.1" or update the download guides to use "v1.8.1-alpha.1"); ensure the
chosen version is applied consistently across CODE_SIGNING_POLICY.md and the
download verification guides.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: bf841a7e-2055-4e75-9f1a-9280ed195378
📒 Files selected for processing (5)
CODE_SIGNING_POLICY.mdREADME.mddocs/README.ja.mddocs/download-verification.ja.mddocs/download-verification.md
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
auto-merge was automatically disabled
May 7, 2026 22:36
Head branch was pushed to by a user without write access
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/download-verification.ja.md`:
- Around line 22-23: Update the version wording in
docs/download-verification.ja.md so it matches CODE_SIGNING_POLICY.md: replace
all occurrences of "v1.8.1 以降" (and the other inconsistent phrasings at the same
spots) with the exact phrase used in CODE_SIGNING_POLICY.md ("v1.8.1-alpha.1 and
later releases" or its Japanese equivalent), ensuring the mentions of
SHA256SUMS.txt and GitHub Artifact Attestations (the sentences that currently
reference the starting version) use that same starting-version string
consistently across the document.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: fe6f34da-021d-4550-9b24-814c3d3f8c3f
📒 Files selected for processing (2)
CODE_SIGNING_POLICY.mddocs/download-verification.ja.md
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
CODE_SIGNING_POLICY.md (1)
23-29: ⚡ Quick winClarify the Windows “Verification” cell to avoid mixed messaging.
The table lists
Wingetunder verification, but later text correctly says Winget is an install path and not a replacement for authenticity checks. Consider changing the table cell to onlySHA-256, attestation(or rename the column to something like “Acquisition + verification”) for consistency.Also applies to: 59-60
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CODE_SIGNING_POLICY.md` around lines 23 - 29, The Windows "Verification" cell in the table currently lists "Winget, SHA-256, attestation" which conflicts with later text; update the Windows row's Verification cell to only "SHA-256, attestation" (or alternatively rename the column to "Acquisition + verification" and adjust all rows accordingly) and apply the same clarification to the matching reference at lines 59-60 so the table and prose consistently treat Winget as an acquisition path, not an authenticity check.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@CODE_SIGNING_POLICY.md`:
- Around line 23-29: The Windows "Verification" cell in the table currently
lists "Winget, SHA-256, attestation" which conflicts with later text; update the
Windows row's Verification cell to only "SHA-256, attestation" (or alternatively
rename the column to "Acquisition + verification" and adjust all rows
accordingly) and apply the same clarification to the matching reference at lines
59-60 so the table and prose consistently treat Winget as an acquisition path,
not an authenticity check.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 2c1a7ea1-86b0-4e55-bf84-c585df599225
📒 Files selected for processing (3)
CODE_SIGNING_POLICY.mddocs/download-verification.ja.mddocs/download-verification.md
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/download-verification.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CODE_SIGNING_POLICY.md`:
- Around line 75-87: The policy currently lists the same identity for Authors,
Reviewers, and Approvers under the "Team roles" section which collapses
four-eyes controls; update the "Authors", "Reviewers", and "Approvers" entries
so that the Approver is a different person or team than the artifact author
(change the Approvers list away from the same handle used for
Authors/Reviewers), and add a short "Compensating controls for solo-maintainer"
subsection that lists required mitigations (e.g., mandatory external audit,
time-delayed signing, dual-key escrow, or documented emergency approval process)
to be used when a distinct approver cannot be provided. Ensure changes reference
the "Team roles" header and update the Authors / Reviewers / Approvers bullet
lists and add the new compensating-controls subsection.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: aa729a2e-3e85-405e-ac13-fd30cd4f16ca
📒 Files selected for processing (1)
CODE_SIGNING_POLICY.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related Issues
#1470
Type of Change
fix/branch)feat/branch)refactor/branch)docs/branch)chore/branch)Screenshots / Videos
Test Plan
Checklist
npm run lint && npm run format/cargo tauri-lint && cargo tauri-fmt)npm test/cargo tauri-test)Summary by CodeRabbit