From f3a9c4bf2acdc7154fbf7b054ae56db13da52006 Mon Sep 17 00:00:00 2001
From: maktak-105 <regza.maktak@gmail.com>
Date: Wed, 23 Sep 2026 14:44:07 +0900
Subject: [PATCH] =?UTF-8?q?docs:=20SignPath=20=E3=82=B3=E3=83=BC=E3=83=89?=
 =?UTF-8?q?=E7=BD=B2=E5=90=8D=E3=83=9D=E3=83=AA=E3=82=B7=E3=83=BC=E3=81=A8?=
 =?UTF-8?q?=E7=94=B3=E8=AB=8B=E4=B8=AD=E3=81=AE=E8=A8=98=E8=BC=89=E3=82=92?=
 =?UTF-8?q?=E8=BF=BD=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                   |  2 ++
 README_jp.md                |  2 ++
 docs/code_signing_policy.md | 22 ++++++++++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 docs/code_signing_policy.md

diff --git a/README.md b/README.md
index a62c6a3..cb93d5f 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,8 @@ The GUI and documentation support English and Japanese; the QDB-style language b
 
 ## Using the binary release
 
+Code signing: Free code signing provided by [SignPath.io](https://signpath.io), certificate by [SignPath Foundation](https://signpath.org). The application is under review; releases published after approval will be signed. See [Code signing policy](docs/code_signing_policy.md).
+
 If you only want to run the app, download the ZIP from GitHub Releases. GitHub Actions builds `QuickFileCopy-binary.zip` on a `v*` tag; the ZIP is not stored in this repository.
 
 - [Latest releases](https://github.com/maktak-105/QuickFileCopy/releases)
diff --git a/README_jp.md b/README_jp.md
index 823cf4e..4ad311f 100644
--- a/README_jp.md
+++ b/README_jp.md
@@ -27,6 +27,8 @@ GUIと文書は日本語／Englishに対応し、QDB形式の言語ボタンで
 
 ## 配布版を使う
 
+コード署名: [SignPath.io](https://signpath.io) による無償のコード署名を利用し、証明書は [SignPath Foundation](https://signpath.org) が発行します。現在申請中で、承認後に公開するリリースから署名されます。詳細は [コード署名ポリシー](docs/code_signing_policy.md)。
+
 実行だけなら GitHub Releases の ZIP を使います。`v*` タグで GitHub Actions が `QuickFileCopy-binary.zip` を作ります。ZIP はリポジトリには置きません。
 
 - [最新版の配布ページ](https://github.com/maktak-105/QuickFileCopy/releases)
diff --git a/docs/code_signing_policy.md b/docs/code_signing_policy.md
new file mode 100644
index 0000000..fa4fd12
--- /dev/null
+++ b/docs/code_signing_policy.md
@@ -0,0 +1,22 @@
+# Code signing policy
+
+Free code signing provided by [SignPath.io](https://signpath.io), certificate by [SignPath Foundation](https://signpath.org).
+
+Status: the application to SignPath Foundation is under review. Releases published before approval are not signed.
+
+## What is signed
+
+- Only Windows executables built from the source code in this repository by the GitHub Actions release workflow (`.github/workflows/release.yml`) and published on [GitHub Releases](https://github.com/maktak-105/QuickFileCopy/releases).
+- Third-party binaries shipped in the package (for example `WebView2Loader.dll` or runtime libraries) are not built by this project and are not signed by it.
+- Every signing request is approved manually by an approver.
+
+## Team roles
+
+- Committers and reviewers: [maktak-105](https://github.com/maktak-105)
+- Approvers: [maktak-105](https://github.com/maktak-105)
+
+All team members use multi-factor authentication for GitHub and SignPath.
+
+## Privacy policy
+
+This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.