Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

• Only qccom-windows-x64.exe, built from a version tag by the public GitHub Actions workflow of the GitHub repository on GitHub-hosted runners.
• Every signed executable is compiled from this project's source code; no third-party executables are embedded.
• Linux binaries are not signed. Builds made on a developer's machine are never submitted for signing.

Team roles

• Committers and reviewers: zenghi
• Approvers: zenghi

Changes proposed by others (pull requests) are reviewed by a committer before merging, and every signing request is approved manually. All team members use multi-factor authentication for GitHub and SignPath.

Privacy

See the privacy policy.

Reporting

If you find a signed file that violates this policy, open a GitHub issue or email 309966755@qq.com.