Code Signing Policy

Free code signing for the Windows builds of Fairstack Coreview is provided by SignPath.io, with the certificate provided by the SignPath Foundation.

• Committers and reviewers: Ruslan Lendel (github.com/ruslanlendel).
• Approvers: Ruslan Lendel (github.com/ruslanlendel). Every release must be approved manually before it is signed.

Only binaries built from the public source code at github.com/FairstackDevelop/Coreview by the GitHub Actions workflow of that repository are submitted for signing. Nothing is built or signed on a personal computer.

Third-party binaries are signed only if they are open source and are built or fetched in the same workflow.

• Changes are reviewed before they reach the main branch.
• A release is built by the automated workflow and sent to SignPath.
• The approver checks the release and approves the signing request. Only then are the files signed.
• Signed installers are published on the GitHub Releases page and on this website with a SHA-256 checksum.

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

More details are in the Privacy Policy for Apps on this website.

All team members use multi-factor authentication for GitHub and SignPath. Report a vulnerability by opening a private security advisory in the GitHub repository.