Code Signing Transparency

Status: not yet signed. PAI's PowerShell flashers (flash.ps1) are not Authenticode-signed in v0.1.0. This page documents our commitment to signing and will be populated with live certificate data and per-release signatures once ourSignPathapplication is approved. Target: v0.2.

The public one-liner irm https://pai.direct/flash.ps1 | iexworks today because piped input bypasses Windows' ExecutionPolicy. Users who save the script to disk and run it under AllSigned orRemoteSigned will currently see a signature failure — sign your own copy locally, or use the one-liner, until signing ships.

Planned signing certificate

Publisher	Open Source Developer, PAI
Thumbprint	`(not yet issued)`
Audit log	SignPath audit log

Verify before running (once signing ships)

$sig = Get-AuthenticodeSignature .\flash.ps1
$sig.Status                    # Must be: Valid
$sig.SignerCertificate.Subject  # Must contain: PAI

Signed releases

No signed releases yet — signing is targeted for v0.2. The first signed release will appear here automatically once the SignPath application is approved and a release is cut.

What if verification fails?

If Get-AuthenticodeSignature returns anything other thanValid, do not run the script. Report the issue at our security advisories page.