Determine the process for digitally signing DLLs and VSIX packages to verify code authenticity and integrity.

[alex-bochkov]

Must be free.

[ErikEJ]

@alex-bochkov There is no "free" option - maybe you have some Azure Credits, then you can use Azure Trusted Signing for 9 USD per month (that is waht I use for signing binaries inside my .vsix and the .vsix itself)

[alex-bochkov]

@ErikEJ - I'm sure you've heard of https://signpath.org/. Did you try to apply there?

[ErikEJ]

Never heard of them, no

[alex-bochkov]

Hi  Alex,

thank you for submitting your OSS Request Form and for sharing your project with us. We will now review your project with a focus on security-related aspects and the project’s reputation. Once this assessment is complete, we will get back to you with the outcome.

If everything is in order and eligible, we can proceed to create a subscription/OSS organization for your project in SignPath, complete with a test certificate. After the technical setup and origin verification have been successfully completed, we can then order and import the production (release) certificate into your subscription.

Thank you for your patience, and we look forward to collaborating with you.

Best regards,
...
SignPath GmbH
https://signpath.io/