Code Signing Policy

Status: the project is applying for free code signing for open-source projects at the SignPath Foundation. Until that is granted, MountSheetSync.exe in the releases is not signed, and Windows SmartScreen may show “Windows protected your PC” (“More info” → “Run anyway”).

What is signed

Only MountSheetSync.exe — the Windows program of Mount Sheet Sync, built from this repository. The World of Warcraft addon consists of plain Lua files and is not signed.

How releases are built

Every release is built by GitHub Actions from a tagged commit of the public repository (release workflow), with the C# compiler that ships with Windows. Nothing is built or signed on a personal computer.
The build contains only code from this repository; it has no third-party binaries.
Signing requests are submitted by the release workflow and must be approved manually before anything is signed.

Team roles

Committers and reviewers: Zlodyaga
Approvers: Zlodyaga

All team members use multi-factor authentication for GitHub and for the signing service.

Privacy

The program sends data only to Google's servers, to your own Google account, when you sign in with Google to keep the mount spreadsheet. It does not transfer information to any other networked system. Details: privacy policy.

Политика подписи кода (по-русски)

Состояние: проект подаёт заявку на бесплатную подпись кода для открытых проектов в SignPath Foundation. Пока её не одобрили, MountSheetSync.exe в выпусках не подписан, и Windows может показать «Windows защитила ваш компьютер» («Подробнее» → «Выполнить в любом случае»).

Подписывается только MountSheetSync.exe. Выпуски собирает GitHub Actions из помеченного коммита открытого репозитория компилятором, встроенным в Windows; каждую подпись вручную одобряет Zlodyaga. Программа передаёт данные только серверам Google — в ваш аккаунт, для ведения таблицы, — и никуда больше: политика конфиденциальности.