Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

The Windows releases of the Codync desktop app: the installer and the executables Codync builds itself. They are built by GitHub Actions on GitHub-hosted runners from the source code at github.com/leepokai/Codync, and each release is signed only after an approver approves it. Third-party programs the app includes, such as the Electron runtime and the computer-use driver, are never signed with this certificate. Signing starts with the first Windows release after SignPath Foundation accepts the project; earlier releases are unsigned.

Team roles

  • Committers and reviewers: leepokai. Changes from anyone else, such as pull requests, are reviewed before they are merged.
  • Approvers: leepokai, who approves every signing request by hand.

Privacy

The data Codync sends, and the services it uses, are described in the Privacy Policy. The Windows installer explains the usage analytics, links that policy and lets you turn analytics off before anything is sent; you can also turn them off later in Settings.

Reporting

If you find a signed file that was not built from this repository, or any other security issue, report it as described in SECURITY.md.
← Back to home