Consider free certificate to sign

[laurentkempe]

Hey, Thanks for your great tool!

Did you consider https://ossign.org/ to get a free certificate to sign so that Windows SmartScreen doesn't complain?

Free for Open Source
We believe in the open source movement. That's why we provide free code signing to qualifying open source projects, helping them build trust with their users in the initial stages.

[Kieirra]

Thanks for the suggestion.
I just tried applying to OSSign, but unfortunately the application fails on my side

More generally, the lack of an officially signed app and Windows SmartScreen warnings are a major blocker for many users. It is frustrating, but for now I am not willing to pay around ~300€/year for a Windows certificate nor ~100€/year for Apple.

If OSSign ends up working or if a real free alternative becomes available, I will be happy to look into it again.

[laurentkempe]

My pleasure.
Sorry, I didn't realize about the notice on their site.
You might have more luck with https://signpath.org/

Warning

Following analysis done by AI for the question
Does the project https://github.com/Kieirra/murmure fulfill this page code of conduct?

Here’s a clear, structured assessment based strictly on the SignPath Foundation Code of Conduct you opened signpath.org and the Murmure repository content github.com.

---

✅ Does Murmure fulfill the SignPath Foundation Code of Conduct?

Below is a point‑by‑point evaluation based on the requirements in the SignPath Foundation terms.

---

🧩 1. No Malware / No PUP

Murmure appears compliant.
The project is open‑source, the code is public, and nothing in the repo suggests malware or unwanted behavior github.com.

---

🧩 2. OSI‑Approved License

Compliant.
Murmure uses GPL‑3.0, which is OSI‑approved github.com.

---

🧩 3. No Proprietary Code

Likely compliant.
The repository contains only open‑source code and dependencies. No proprietary blobs are visible in the repo structure github.com.

---

🧩 4. Actively Maintained

Compliant.
Recent commits, active issues, and a release 3 weeks ago show active maintenance github.com.

---

🧩 5. Released in the form to be signed

Compliant.
The project publishes MSI, DMG, and AppImage installers in GitHub Releases github.com.

---

🧩 6. Documented

Compliant.
The README is detailed and describes functionality, installation, and usage github.com.

---

🧩 7. No Hacking Tools

Compliant.
Murmure is a speech‑to‑text tool. It does not scan ports, exploit vulnerabilities, or circumvent security measures github.com.

---

🧩 8. Respect User Privacy

Compliant.
The project explicitly states:

• “All processing happens locally.”
• “No data ever leaves your computer.”
• “Zero tracking, zero analytics.”
  These statements align with SignPath’s privacy expectations github.com.

---

🧩 9. Announce System Changes

Likely compliant.
Murmure does not appear to modify system configuration beyond normal installation.

---

🧩 10. Provide Uninstallation

Compliant.
Installers (MSI, DMG, AppImage) inherently support uninstallation or removal.

---

🧩 11. Contributor Security Requirements

This is where Murmure currently does not fully comply.

SignPath requires:

✔ MFA for all contributors

GitHub does not show whether MFA is enforced. This must be configured at the organization level.

✔ Defined roles: Authors, Reviewers, Approvers

The repository does not currently publish:

• a “Code signing policy” page
• a list of committers/reviewers/approvers
• a link to GitHub teams as required

These are mandatory for SignPath.

---

🧩 12. Code Signing Policy Page

Not compliant yet.

SignPath requires a page containing:

• “Code signing policy” (exact wording)
• “Free code signing provided by SignPath.io, certificate by SignPath Foundation”
• Team roles (committers, reviewers, approvers)
• Privacy policy statement

Murmure does not have such a page in the repo or website github.com.

---

🧩 13. Artifact Metadata Requirements

SignPath requires:

• ProductName set consistently
• ProductVersion set consistently
• Enforced via metadata restrictions

The Murmure repo does not show whether Tauri build metadata is configured to meet these constraints. This must be checked in src-tauri/tauri.conf.json (not visible in the snippet).

---

🧩 14. “Sign your own binaries only”

Likely compliant.

Murmure builds its own binaries from its own source code.
It includes upstream libraries (Rust crates, JS packages), which is allowed.

---

🧩 15. No System Circumvention

Compliant.
Nothing suggests attempts to bypass signing constraints.

---

🧩 16. Reputation Requirement

SignPath requires a project to have a verifiable reputation.
Murmure has:

• 300+ stars
• Active contributors
• Public releases
  This is generally positive, but SignPath makes the final call.

---

✅ Final Verdict

Murmure meets most technical and behavioral requirements, but does NOT yet fulfill the mandatory repository‑level requirements:

Requirement	Status
Open‑source license	✔
No malware	✔
No proprietary code	✔
Actively maintained	✔
Released	✔
Documented	✔
Privacy‑respecting	✔
No hacking tools	✔
MFA for contributors	❓ (unknown)
Defined team roles	❌ Missing
Code signing policy page	❌ Missing
Privacy policy page	❌ Missing
Metadata enforcement	❓ (needs verification)

Therefore: Murmure does not yet fully comply with the SignPath Foundation Code of Conduct, but it is very close and only needs to add the required policy pages and team structure.

---

If you want, I can draft a complete, ready‑to‑publish “Code Signing Policy” page tailored for Murmure so the project becomes compliant.

[Kieirra]

Thanks a lot for the detailed breakdown, it’s really helpful.

I’m OK to move forward with SignPath. If you’re OK to draft a Code Signing Policy for Murmure, that would be great. I’ll take care of the Privacy Policy page and the metadata on my side.

[laurentkempe]

That is fantastic news @Kieirra can't wait to see the new version

[laurentkempe]

I also started to work on having winget supported for Windows installation. I will propose a PR over the weekend.

[Kieirra]

Thank you! I admit I am not familiar with the Winget process, so your help is appreciated.

However, there is a technical constraint regarding the tauri-plugin-updater. Since this plugin forces a single installer format per OS (I chose .msi), the app's internal auto-update logic might conflict with Winget.

You might need to disable the download/update trigger in the frontend when the app is installed via Winget. Otherwise, the app will try to update itself independently using the internal mechanism, which isn't ideal. (I will need to do the same with .deb)

Update on the code signing: I’ve made progress on both .msi and .exe files. The GitHub Actions workflow for testing and releasing binaries is now validated. I am currently waiting for the final validation from SignPath to officially start signing the releases.

[laurentkempe]

Welcome, my pleasure!

However, there is a technical constraint regarding the tauri-plugin-updater. Since this plugin forces a single installer format per OS (I chose .msi), the app's internal auto-update logic might conflict with Winget.

On Windows. does tauri-plugin-updater updates using the msi? I am not sure following my finding, apparently the preferred way if .exe for incremental update. If not, then I think it can be problematic.

You might need to disable the download/update trigger in the frontend when the app is installed via Winget. Otherwise, the app will try to update itself independently using the internal mechanism, which isn't ideal. (I will need to do the same with .deb)

I am not sure how we could do that. We can discuss it in the PR, so that we can do the change there too #137

Update on the code signing: I’ve made progress on both .msi and .exe files. The GitHub Actions workflow for testing and releasing binaries is now validated. I am currently waiting for the final validation from SignPath to officially start signing the releases.

So nice to read that, congratulations 🎉

[Kieirra]

https://signpath.org/projects/murmure/