Code signing policy
How SplitNest's Windows releases are built, who may approve signing, what would be signed, and how to check a download.
Status: SplitNest's Windows releases are not code signed yet. The project intends to apply to the SignPath Foundation for free code signing for open-source projects. Until an application is approved and this page is updated, every release is unsigned, and Windows SmartScreen may warn about it (see Download).
Once approved, Windows releases will carry this statement:
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
The publisher shown by Windows for signed files will then be SignPath Foundation.
Team roles
SplitNest is maintained by one person. The roles the SignPath Foundation requires are all held by the repository owner:
| Role | Who | What it means |
|---|---|---|
| Committer (author) | Souf CH (@chafian) | May change the source code without further review. |
| Reviewer | Souf CH (@chafian) | Reviews and merges every contribution from anyone who is not a committer (pull requests). |
| Approver | Souf CH (@chafian) | Approves each signing request by hand, after checking that it comes from the release workflow for a tagged version. |
Requirements for everyone holding a role: multi-factor authentication on GitHub and on SignPath, and no use of signing for anything other than this repository's own release builds.
What is signed, and what is not
Only binaries that the repository's release workflow builds for SplitNest are signed: the application splitnest.exe, the installer SplitNest-win32-x64-Setup.exe, and Squirrel's launcher generated for SplitNest (pending confirmation by the SignPath Foundation that it may be signed).
Files built by other open-source projects are shipped exactly as those projects publish them and are never signed with SplitNest's certificate: Electron's libraries, node-pty's native modules and winpty, Microsoft's ConPTY files (already signed by Microsoft) and Squirrel's Update.exe. Every release lists every binary, marked ours or upstream, with its SHA-256 hash, version information and signature status.
Every signed binary has product name SplitNest, company SplitNest and the release's version as product version; the release build fails if a file differs.
How releases are built
- Only by GitHub Actions, on GitHub-hosted Windows runners, from a version tag in the public repository, with dependencies installed from the committed lockfile.
- The workflow runs the tests, builds the installer and the portable ZIP, and publishes them to GitHub Releases with SHA-256 checksums. Build logs are public.
- Once signing is approved, each signing request is approved by hand, and a release is only published when every expected file is signed and the checks pass. A release is never published partly signed.
Privacy
See the privacy policy. SplitNest has no telemetry or analytics. Starting with version 0.2.0 it checks for updates (enabled by default, explained when the app first starts, and can be turned off). That check contacts GitHub and Electron's update service; their privacy terms are linked from the privacy policy.
Verifying a download
- Compare the SHA-256 hash of your download with
SHA256SUMS.txtfrom the same release (instructions). - For signed releases, check the signature in PowerShell:
Get-AuthenticodeSignature .\SplitNest-win32-x64-Setup.exe.
Reporting a problem
If you believe a SplitNest binary was signed improperly or is harmful, report it privately as described in the security policy. This policy is also in the repository: CODE_SIGNING.md.