Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Release installers and executables are signed through SignPath.io. The certificate is issued to SignPath Foundation, which acts as the publisher of this open-source project and may revoke access if these rules are violated.

The project accepts the SignPath Foundation conditions for Open Source projects: MIT-licensed code only, no proprietary components in signed packages, no malware, and manually approved signing requests for every release.

Team roles

Committers and reviewers: fraches05 — owns the repository, writes and reviews all changes. External pull requests are reviewed before merging.
Approvers: fraches05 — approves each signing request for a release.

Multi-factor authentication is enabled on both the GitHub account and the SignPath account.

What gets signed

OpenCodeNotch-Setup-<version>.exe — the per-user NSIS installer.
The application executable inside the installer and the portable ZIP.

Only binaries built from this repository's source are signed. Third-party components bundled by Electron are included unmodified; they are not signed with this project's certificate.

Build and reproducibility

Installers are produced from source with electron-builder in the project's release workflow for Windows x64. Each release is built from a tagged commit, so a signature can be traced back to the exact source and build scripts in the repository.

Checksums for every artifact are published in the release notes, so you can verify a download independently of the signature.

Privacy policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

OpenCode Notch connects only to the OpenCode service running on the same machine, over its local HTTP API.
It contacts GitHub only to check whether a newer release exists; no session content, prompts or file paths are sent.
Preferences (window position, theme, language, mute) are stored locally in %APPDATA%\OpenCode Notch\notch.json and are never uploaded.
No telemetry, analytics or crash reporting is included.
Uninstalling removes the application; the preferences file is kept unless you delete it yourself.

Verifying a download

Every release lists SHA256 hashes for the installer and the portable ZIP:

Get-FileHash .\OpenCodeNotch-Setup-<version>.exe -Algorithm SHA256

If Windows still shows an unknown publisher, the build was downloaded before signing was enabled or the file was modified — compare the hash with the release notes before running it.

Until signing is active, the installer is unsigned and Windows SmartScreen will ask for confirmation: choose More info → Run anyway.

Reporting a problem

If you believe a signed OpenCode Notch artifact violates this policy, open an issue at github.com/fraches05/opencode-notch/issues or report it to support@signpath.io with the artifact name and evidence.