Code signing policy

This policy covers the Windows files of EZbuild for Revit, the free Revit plug-in. It does not cover the EZbuild compliance-review web platform, which is a separate product.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

EZbuild for Revit is applying for SignPath Foundation’s free code signing for open-source projects. Until signing is in place, its Windows files are unsigned.

What is signed

• Only files built from the source of the open-source repository qq624444359/EZbuild-Revit, by its GitHub Actions workflow (.github/workflows/build.yml) on GitHub-hosted runners. Nothing built on anyone’s own computer is signed.
• That is the add-in assembly, EZTable.dll, built once for Revit 2026 (.NET 8) and once for Revit 2027 (.NET 10).
• The third-party libraries bundled with it — ClosedXML, DocumentFormat.OpenXml, SixLabors.Fonts, XLParser, Irony and ExcelNumberFormat — are not signed as EZbuild for Revit’s. They keep their own publishers’ signatures, if they have any.
• The pyRevit edition is Python source and contains no executable files, so there is nothing in it to sign.
• Every signing request is approved by hand by an approver listed below.

The certificate is issued to SignPath Foundation, so Windows names SignPath Foundation, not EZbuild, as the publisher of a signed file. You can check this under the file’s Properties → Digital Signatures.

Team and roles

• Committers and reviewers: qq624444359
• Approvers: qq624444359

Contributions from anyone else reach the main branch only as pull requests reviewed and merged by a committer.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

In practice EZbuild for Revit makes no network connections at all. It reads the Excel file you choose and draws it in Revit, entirely on your own machine. It has no account, no telemetry and no update check. The full privacy policy has the details.

Questions and reports

If you believe a file was signed that should not have been, or have any other question about this policy, email pitayadesign.nz@gmail.com.