Code signing policy

Visual Dynamics is open source under the MIT License. Its installers are built from the public repository by GitHub Actions. The macOS images are signed so that your operating system can confirm where they came from; the Windows installer and the Linux AppImage are not signed yet.

Windows

The Windows installer is not signed, and Windows SmartScreen shows a warning before running it. Before you run it, check the file against the SHA256SUMS attached to its release.

The SignPath Foundation signs open source projects at no cost. Visual Dynamics has applied, and the Foundation asked for more public visibility first (users, contributors, references elsewhere); the license and the code met its terms. The project will apply again once it has that visibility. Until a certificate is issued, the installer stays unsigned rather than being signed under a name that is not the author's.

When Windows signing is in place, only release builds will be signed: the installer the release workflow builds from a version tag in the public repository, and the application inside it. Nothing built on a personal machine will be submitted for signing.

macOS

The two macOS disk images, one for Apple silicon and one for Intel, are built on GitHub's runners, signed with the author's Apple Developer ID and notarized by Apple. A release build that cannot be signed and notarized does not finish.

The macOS app updates itself through Sparkle. Each update is signed with the project's EdDSA key, and the app checks that signature against the public key it carries, and checks that the new app has the same Developer ID, before installing anything.

Linux

The AppImage is not signed. Check it against the SHA256SUMS attached to its release.

Team roles

• Committers and reviewers: Brandon Zwink (@bzwink). Changes from anyone else arrive as pull requests and are reviewed before they are merged.
• Approvers: Brandon Zwink. Every signing request is approved by hand.

Everyone with these roles uses multi-factor authentication on GitHub and on any signing service the project uses.

Privacy policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

The only request it makes is File → Check for Updates…, and only when you choose it from the menu. The full privacy policy says what that request sends.