Ballot FORUM-8: Establishment of a Code Signing Working Group

Ballot overview

• Ballot FORUM-8 proposed establishing a Code Signing Certificate Working Group.
• The charter says the working group would discuss, adopt, and maintain policies, frameworks, and standards related to code signing certificates issued by third-party Certificate Issuers under a publicly trusted root.
• The charter explicitly excludes self-signed code, platform-supplier-managed code signing, and certificates issued under a non-publicly trusted root.

Voting results

• The voting period ended and the ballot passed.
• Certificate Issuers: 24 yes votes, 0 no votes, 0 abstentions.
• Certificate Consumers: 3 yes votes, 0 no votes, 0 abstentions.
• The page states the bylaw requirements were met for both Certificate Issuers and Certificate Consumers.
• Quorum was met.

Charter and governance details

• The charter states it takes effect upon approval of the CA/Browser Forum by ballot conducted in accordance with Bylaw 5.3.
• Dean Coclin was named chair until the first Working Group Teleconference, after which the group would select a chair and vice-chair.
• The chair and vice-chair would serve until October 31, 2020, or until replaced, resigned, or otherwise disqualified.
• The working group would communicate primarily through public listserv-based email and could hold periodic calls or face-to-face meetings.
• The IPR Policy and antitrust policy apply to all working group activity.

Scope highlights

• The working group scope includes EV Code Signing Guidelines v. 1.4 and subsequent versions.
• It also includes the Version 1.0 Draft of November 19, 2015, Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates, subject to a written finding that the provenance of the document is sufficiently covered by the Forum’s IPR Policy.
• The charter covers verification requirements, private key protection, issuance and revocation, use controls, engagement with AV vendors and researchers, certificate profiles, and CA operational practices.

Dates

• The evidence explicitly states that the charter would take effect upon approval, but it does not provide a specific calendar effective date for the charter itself.
• The only explicit calendar date tied to a charter governance term is October 31, 2020 for the initial chair and vice-chair term.