Code signing policy
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
What is signed
Only binaries built from the nite-net/nite repository by its release workflow on GitHub Actions, from a tagged commit, are signed. Nothing built on a developer's machine is. The build scripts and workflow are part of the repository and are reviewed like the rest of its source.
Third-party components that NiteFx downloads when it runs (the esbuild and Dart Sass binaries, and npm packages) are not part of NiteFx's packages and are not signed by this project. Their authors publish them.
Team roles
| Role | Members |
|---|---|
| Owner | Tim McQueen ([email protected]) |
| Committers and reviewers | Tim McQueen ([email protected]) |
| Approvers | Tim McQueen ([email protected]) |
- Committers may change the source code without further review.
- Reviewers review every change proposed by someone who is not a committer, such as a pull request from a contributor, before it is merged.
- Approvers approve each signing request by hand. Every release is approved individually.
All team members use multi-factor authentication for GitHub and SignPath.
Privacy
See the privacy policy. In short: NiteFx collects no information, and it transfers data to other networked systems only when you ask it to.
Reporting a problem
If you believe a signed NiteFx binary is malicious or was not built from this project's source, open an issue or email [email protected].