Code signing policy.

Status: prepared, not in effect. Rawtonic’s Windows downloads are not code-signed yet. This policy is written for signing through the SignPath Foundation programme for open-source projects and applies from the first release signed that way; its release notes will say so. Until then, check downloads with their SHA-256 (below).

Once in effect: Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

• Only Windows files built from the public repository rawtonic-app/rawtonic by its GitHub Actions workflow windows-installer.yml on GitHub-hosted runners, from a release commit on main. Nothing built on a developer’s computer is signed.
• The files: the app rawtonic-app.exe, the installers Rawtonic_<version>_x64.msi and Rawtonic_<version>_x64-setup.exe, and the copy of rawtonic-app.exe in Rawtonic_<version>_x64-portable.zip.
• Third-party libraries shipped with the app (for example Microsoft’s ONNX Runtime DLLs) are not signed by this project; they keep their makers’ own signature, if any.
• Every signing request is approved by hand by an approver, for one release at a time.

Team and roles

• Committers and reviewers (may change the source without further review): members of the rawtonic-app organisation: Niels Franke.
• Approvers (decide whether a release is signed): owners of the rawtonic-app organisation: Niels Franke.

Changes from anyone else (pull requests) are reviewed by a committer before they are merged. All team members use multi-factor authentication for GitHub and SignPath.

How to check a download

• Signature (signed releases): right-click the file → Properties → Digital Signatures; the signer is SignPath Foundation. In PowerShell, Get-AuthenticodeSignature on the file must show Valid and a certificate issued to SignPath Foundation.
• Checksum (every release): Get-FileHash on the file must print the SHA-256 listed in the release’s SHA256SUMS-windows.txt. This catches a damaged download; on its own it does not prove who made the file.
• If Windows or the browser holds a download back: Windows blocked the download?

Privacy

Rawtonic sends nothing on its own except a startup update check: at most once every 24 hours it asks GitHub’s public Releases API whether a newer version exists. It is on by default and can be turned off in Preferences → General (“Check for updates at startup”). Everything else that goes online (AI model downloads, maps, problem and crash reports, opt-in usage statistics) happens only when you ask for it, after showing what is sent. Details: Privacy.

Contact

Questions about this policy or a suspected misuse of a signature: hello@rawtonic.cc, or an issue on GitHub.