Code signing policy
How Komorebi's Windows releases are signed, who approves each signing, where signed builds come from and what the signed program does with your data.
Free code signing provided by SignPath.io, certificate by SignPath Foundation
Status
Komorebi is applying to SignPath Foundation for free code signing. Until a certificate is issued, releases are not Authenticode-signed, and Windows SmartScreen may warn when you run the installer. Every release on GitHub carries the installer's SHA-256 (.sha256) and an Ed25519 signature (.sig) that the in-app update verifies. How updates are verified.
What is signed
Only files built from the Komorebi repository: the program komorebi.exe and the installer komorebi-<version>-setup.exe. Programs from other projects are not signed with this certificate.
Roles
| Role | Person | What it means |
|---|---|---|
| Author | Mário Silva | Writes and reviews changes to the code and commits them to the public repository. |
| Approver | Mário Silva | Approves each release's signing request by hand. |
Builds
Signed builds come from the public repository on GitHub, github.com/RusticStack/komorebi, built by GitHub Actions from a commit in that repository. Nothing built on a personal computer is signed with this certificate. Releases up to and including 0.7.0 were built and published by hand and are not Authenticode-signed.
Privacy
Komorebi collects no data. It sends nothing to the project or to any third party: no telemetry, analytics or crash reports. Update checks contact GitHub only: one HTTPS request to api.github.com for the latest release, when you press Check for updates or at most once a day with automatic checks on, and a download from github.com only when you press Download and install.
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. Privacy statement.