[DECISION] authorize Florian to sign code-signing certificate power of attorney

Hello,

the following decision, which has been taken in private today, is now made public in accordance with our statutes.

in order to get the prolongation of the code-signing certificate for Xisco, the certificate authority needs the attached document signed.

I therefore call for the following vote:

  • authorize Florian to sign the attached document

  • in case the certificate authority does not accept this signature, authorize any other board member to sign

The vote runs 72h from now.

The document is called “power of attorney” and allows me to request a code signing certificate with the Certum certificate authority.

The Board of Directors at the time of voting consists of 7 seat holders (not including deputies). In order to be quorate, the vote needs to have 1/2 or more of the Board of Directors members, which gives 4.

A total of 5 Board of Directors members have participated in the vote.

The vote is quorate.

A quorum could be reached with a simple majority of 3 votes.

Result of vote:
5 approvals: Eliane, Mike, Sophie, Paolo, Osvaldo
0 abstain
0 disapprovals

Decision: The proposal has been accepted.

Florian

  1. The attached document is missing.
  2. Shouldn’t Florian (+ maybe someone else, e.g. BoD member designated at the beginning of every BoD term) have standing authority to sign this sort of documents (periodic prolongation of terms of privileges at third parties for TDF employees)? Does it make sense for individual documents of this kind to require a BoD vote?

The document is like this one: https://files.certum.eu/documents/repsitory/7-doc-templates/Power-of-Attorney-NQC.pdf

1 Like

That is not always working reliably. The board is the legal representative of TDF. Depending on the contractual partner, they might reject other people’s signatures including mine. An explicit vote on the current matter sometimes helps - for the certificate authority, it might turn out it must be an actual board member signing. We’ll see, I am currently waiting for a reply from their support, but clearly the CA got more strict and things get more tedious.

The BoD is the legal representative, and they empower you to do something. When you sign something or make a request, you can attach the empowering document. I doubt this should be a problem. In large companies with many requests, the BoD would need to spend all day just authorizing these things.

In principle I agree with you. In reality, the certificate provider did not accept this, they insist on having Eliane sign on the form. Of course, one can challenge them, but that unlikely leads to results, nor will it be faster.

We had similar situations with banks in the past. It happens, it is annoying, but to some degree is - sadly - part of daily business.

Is it really like that for every charitable organization (Gemeinungzikeit IIANM) in Germany? If not - maybe we can figure out how others get around these restrictions (e.g. via our Advisory Board?); if not - maybe there is some sort of venue, e.g. in Berlin or at the federal level, where representatives of several charitable-orgs could bring this with regulators or even legislators? Along with other “quality-of-life” issues for such organizations?

Most of the time it works without problems. Special cases are usually banks, where most activities can be carried out by a warrant, just a few (e.g. adding new warrants) can only be done by legal representatives, i.e. the board. Similar for foundation authorities that usually accept a warrant.

The certificate authority finally accepted the document signed by Eliane, but they were really one of the few cases where they insisted on a particular signature. I don’t know if this is due to the rules put in place for code signing certificates. We had something similar with the closure or a Bitcoin account some years ago.

I am not sure if comparison is easy, because I don’t know that many (European) FLOSS foundations which get a code signing certificate. We mostly need it for Windows from what I recall.

But in general I agree, it’s an annoyance…