Free code signing provided by SignPath.io, certificate bySignPath Foundation.
What is signed
The Windows installer for the Bramble desktop app is Authenticode-signed through SignPath. The certificate is issued to the SignPath Foundation, so Windows namesSignPath Foundation as the verified publisher when you run the installer. That is expected, and it is how you can tell a genuine installer from one that was altered after it was signed.
Only Bramble's own software is signed this way. Bramble does not use this certificate to sign anyone else's programs or libraries.
How a signed build is made
- From the public source, on GitHub's machines. The installer is built by GitHub Actions on GitHub-hosted runners, directly from the publicsource repository. Nothing built on a personal computer is ever submitted for signing. SignPath verifies where each build came from using information supplied by GitHub itself, not by the build.
- Every release is approved by hand. A signing request is only fulfilled after an approver (below) reviews and approves it in SignPath.
- The build scripts are source too. The workflow that builds and signs the installer lives in the repository and goes through the same review as the rest of the code.
Team roles
- Committers and reviewers:@flythenimbus. Changes from anyone else arrive as pull requests and are reviewed before they are merged.
- Approvers: @flythenimbus, who approves each signing request.
Everyone in these roles uses multi-factor authentication for GitHub and for SignPath.
Privacy
Bramble does not transfer any information to other networked systems unless you ask it to, with one exception: the desktop app checks for updates when it opens, which you can turn off. Every network connection Bramble can make is described in the privacy policy.
Other downloads
This policy covers the Windows installer, the only download signed through SignPath. Bramble's other downloads are signed through their own channels: the macOS app with Bramble's Apple Developer ID and notarized by Apple, the browser extensions and the iOS app by their stores, and the Android and Linux releases with Bramble's own release keys.
Reporting a problem
If you think a signed Bramble installer is not what it should be, or you find a security issue, please report it privately throughGitHub's security advisories.