Code signing policy

Code signing is being set up. Releases up to now are not signed yet; this policy applies to every signed release once SignPath Foundation has approved the project.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

The Windows installers of Releases (.exe and .msi) are signed so that Windows can show who published them and that they weren't changed after the build. Signing only covers files built from this project's own source code.

How a release gets signed

• Every release is built by GitHub Actions from the public source repository, with the build steps in the repository itself. Nothing is built or signed on a personal machine.
• SignPath verifies that the files come from that automated build before it signs them.
• Each signing request is approved by hand by an approver listed below.

Team roles

• Committers and reviewers: Endogen. Changes from anyone else are reviewed before they are merged.
• Approvers: Endogen

All members use multi-factor authentication for GitHub and SignPath.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. The privacy policy describes what the app sends and where.

Reporting a problem

If you believe a signed file of this project is malicious or was not built from its source, please open an issue on GitHub.