Code signing policy
Who signs amenbo's releases, how they are built, and where they are distributed.
This page exists so that anyone receiving an amenbo release can tell whether it really came from us. It states what is signed, how it is built, who approves a signature, and where the binaries are published.
What you can verify today
Two checks apply to releases on every platform.
- GitHub build attestations — these record which repository, which commit, and which
workflow produced an artifact. Anyone can check one with
gh attestation verify. - minisign signatures for updates — when the app updates itself, it verifies the signature of what it downloaded.
The artifacts
| Artifact | Contents |
|---|---|
amenbo-app-windows-x64-setup.exe | Installer for the GUI app (NSIS). It bundles the CLI and puts it on the PATH |
amenbo-windows-amd64.exe | The standalone CLI binary |
Authenticode signing (not yet in place)
Windows artifacts do not currently carry an Authenticode signature. When signing is introduced, it will run under the following terms.
- Only artifacts built by CI are submitted for signing. Nothing built on a developer’s own machine is signed.
- Every signing request is approved explicitly by the maintainer. There will be no path where a build is signed and shipped unattended.
- Signed binaries carry file metadata attributes for the product name and version.
- The minisign signature for updates is computed before an Authenticode signature is applied, so both hold on the same file.
How they are built
- The source lives in the public repository ShiroDoromoto/amenbo under Apache-2.0. It contains no proprietary components.
- Releases are built by the GitHub Actions release workflow
(
.github/workflows/release.yml) from that repository’s source. Nothing built on a developer’s own machine is ever distributed.
Team and roles
amenbo is maintained by one person, who holds all of the roles below.
| Role | Person |
|---|---|
| Author (builds, requests signatures) | ShiroDoromoto |
| Reviewer (reviews changes) | ShiroDoromoto |
| Approver (approves signing requests) | ShiroDoromoto |
Everyone involved in signing keeps multi-factor authentication enabled on both the signing platform and the source repository.
Where releases are distributed
Releases are published in exactly two places.
- GitHub Releases: https://github.com/ShiroDoromoto/amenbo/releases
- The Start page on this site, which links to those releases.
Privacy
Signing collects no user data. amenbo has no central server and your data never leaves your machine; see Privacy for the details.