Code Signing Policy

This project signs and distributes release artifacts. Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

• Windows installer packages and executables (.exe, .msi) published on GitHub Releases.

Build and signing process

• All artifacts are built from the public repository zerx-lab/FluxDown using GitHub Actions CI.
• Only CI-built artifacts are submitted to SignPath for signing.
• The private key is held by SignPath on HSM. This project does not store or have access to the private key.
• Every signing request requires explicit manual approval by the maintainer.

Team roles

• Authors (commit access, can modify the repository without additional reviews): zerx-lab
• Reviewers (all external pull requests are reviewed before merge): zerx-lab
• Approvers (each signing request requires explicit approval): zerx-lab

Other platforms

• macOS: artifacts are currently unsigned; users should obtain artifacts only from the official GitHub Releases page. See macOS Gatekeeper instructions.
• Linux: artifacts (AppImage / deb / Arch / portable) are currently not cryptographically signed; obtain them only from the official GitHub Releases page.

Privacy policy

FluxDown does not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it (e.g. checking for updates on GitHub Releases). See the full Privacy Policy.