# Code signing policy

Status as of 2026-11-07: **inactive; Foundation application declined**.
The owner submitted the application and received the decision on 2026-11-07.
SignPath cited insufficient public recognition and independent adoption
signals. It invited a later application after broader recognition. No
acceptance or dependency exception was granted. Signing remains disabled and
no R VPN-owned binary has a trusted Authenticode signature from this preparation.

After acceptance the policy will identify the service as follows:
"Free code signing provided by [SignPath.io](https://about.signpath.io/),
certificate by [SignPath Foundation](https://signpath.org/)".
Until acceptance that sentence is a proposed attribution, not a claim of
sponsorship. The certificate publisher will be SignPath Foundation, while the
product metadata remains R VPN / R PROJECT.