Code signing policy

Every Flobro release is built automatically from the public source code. This page describes who can change that code and how releases get signed.

Signing

Windows builds: free code signing provided by SignPath.io, certificate by SignPath Foundation. macOS builds are signed and notarized with an Apple Developer ID. Binaries are produced by GitHub Actions directly from the source repository; no release is built on a personal machine.

Team roles

Committers and reviewers: members of the flobro organization
Approvers: organization owners

Changes proposed by anyone outside the team are only merged after review by a team member. Every signing request is approved manually by an approver.

Privacy

Flobro only transfers the anonymous usage statistics described in the privacy policy, and only when that setting is on. It can be switched off in the app and in the extension.