Code signing policy
Signing provider
Section titled “Signing provider”Free code signing provided by SignPath.io, certificate by SignPath Foundation.
The certificate belongs to SignPath Foundation, so Windows shows SignPath Foundation as the publisher of signed files.
What gets signed
Section titled “What gets signed”- The Windows installer (
LibreShard-Setup-<version>.exe) and the LibreShard program inside it. - Only files built from the source code in libreshard/libreshard, by GitHub Actions, from a release tag. Nothing built on a personal computer is ever signed.
- Linux and macOS packages aren’t signed through SignPath. Check them against
SHA256SUMS.txt.
How a release is signed
Section titled “How a release is signed”- A maintainer creates a version tag (
v*). Only the project’s administrators can create these tags. - GitHub Actions builds the installers from that tag (release workflow) and sends the Windows files to SignPath.
- An approver checks that the request comes from that build and that tag, and approves it by hand. Every release needs its own approval.
- The signed files go into a draft release, which a maintainer reviews and publishes.
Team roles
Section titled “Team roles”| Role | Who |
|---|---|
| Committers and reviewers | Members of the libreshard organization: today, Gabriel Hernandez |
| Approvers | The organization’s owners: today, Gabriel Hernandez |
Every change reaches the main branch through a pull request that passes the automated checks.
Contributions from people outside the team are reviewed by a team member before they’re merged.
Team members use multi-factor authentication for GitHub and SignPath.
Privacy
Section titled “Privacy”LibreShard will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
The app only talks to the devices you pair on your own network: there’s no telemetry, no account and no cloud service. If a future feature contacts the internet (automatic updates, for example), this page will say what it contacts, and you’ll be able to turn it off. The website’s own privacy notes are on the security page.
Report a problem
Section titled “Report a problem”If a signed file looks wrong, or you think something was signed that shouldn’t have been, write to [email protected].