Code signing policy

Free code signing for the Windows version of LabShelf Helper is provided by SignPath.io, and the certificate is issued by the SignPath Foundation. The macOS helper is not signed by Apple; the manual explains why and how to check it instead.

What is signed

Only the files the helper release workflow builds from the LabShelf repository: the Windows helper program, then the Windows installer that carries the signed program. The repository is open source, and no other software is signed with this certificate.

How a release is made

• A release starts when the maintainer pushes a helper-v* tag. The workflow runs on GitHub's hosted runners and builds the program from the tagged source; nothing is built on a personal computer.
• The workflow uploads the unsigned file as a build artifact and submits it to SignPath, which signs it only when the request comes from this repository's workflow and the maintainer approves the signing request manually.
• Each published file has a build attestation and a SHA-256 in SHA256SUMS, so anyone can check that it came from the workflow.

Roles

LabShelf has one maintainer, Luca Nasser, who writes and reviews the code and approves each signing request. The maintainer's account on GitHub and SignPath uses multi-factor authentication.

Privacy

LabShelf Helper does not collect or send your data to the maintainer or to SignPath. It contacts a network host only when you ask it to install a TeX, and to look for a newer helper on GitHub. The privacy section of the manual lists the hosts the apps contact.