SignPath follow-ups: package version, artifact cleanup, signing policy

.github/workflows/signpath_sign.yml

@@ -13,7 +13,7 @@ on:
         default: test-signing
 
 permissions:
-  actions: read   # the SignPath action downloads the uploaded artifact through the GitHub API
+  actions: write  # SignPath downloads the unsigned artifacts through the API; the last step deletes them
   contents: read
 
 jobs:
@@ -125,3 +125,15 @@ jobs:
             bin/SftpFileSystem.x86.*.zip
             bin/chocolatey/logexpert.*.nupkg
           retention-days: 7
+
+      # Leaves only the signed artifact, so the unsigned installer cannot be downloaded by mistake.
+      # Skipped when an earlier step failed, so the unsigned files stay available for debugging.
+      - name: Delete unsigned artifacts
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          foreach ($id in '${{ steps.upload-unsigned-app.outputs.artifact-id }}', '${{ steps.upload-unsigned-setup.outputs.artifact-id }}') {
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id"
+            if ($LASTEXITCODE -ne 0) { exit 1 }
+          }

README.md

@@ -39,6 +39,19 @@ Requirements
 * <https://dotnet.microsoft.com/en-us/download>
 * .NET 10 (<https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/runtime-desktop-10.0.0-windows-x64-installer>)
 
+## Code signing policy
+
+Free code signing provided by [SignPath.io](https://about.signpath.io), certificate by [SignPath Foundation](https://signpath.org)
+
+Only LogExpert's own binaries are signed. Third-party libraries shipped with LogExpert are not signed by this project.
+
+Team roles:
+
+* Committers and reviewers: [Hirogen](https://github.com/Hirogen)
+* Approvers: [Hirogen](https://github.com/Hirogen)
+
+Privacy policy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. For example, the SFTP plugin only connects to the servers the user opens files from.
+
 ## Command line
 
 Open a log at a specific line:

build/Build.cs

@@ -269,7 +269,9 @@ protected override void OnBuildInitialized()
                 .SetProject(columnizerFolder / "ColumnizerLib.csproj")
                 .SetConfiguration(Configuration)
                 .SetOutputDirectory(BinDirectory)
-                .SetVersion(VersionString));
+                .SetVersion(VersionString)
+                // Directory.Build.props pins PackageVersion, which would otherwise win over Version.
+                .SetProperty("PackageVersion", VersionString));
         });
 
     Target Pack => _ => _

src/docs/CODE_SIGNING.md

@@ -104,7 +104,8 @@ logs.
 3. The run should:
    - print a table of signed binaries in *Check binary signatures*. With the test certificate the
      status is `UnknownError` (untrusted root), not `Valid`. That is expected.
-   - finish with a `signed-packages-test-signing` artifact.
+   - finish with a `signed-packages-test-signing` artifact. The two unsigned artifacts are deleted
+     at the end of a successful run, and kept when a step fails, so they can be inspected.
 4. Download the artifact, right-click `LogExpert-Setup-*.exe` → *Properties* → *Digital Signatures*.
    A signature from the SignPath test certificate should be listed.
 5. Install it and make sure LogExpert starts **and the built-in columnizers load**. This confirms