Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

The DeskAuth program files (DeskAuth-version-*.exe) attached to each release on the GitHub releases page are signed. They are:

• built by GitHub Actions, on GitHub's own servers, from the public source code in the DeskAuth repository at the release's tag, using the release workflow
• checked by SignPath to have come from that build before they are signed
• signed only after an approver from the team below has approved that release

To check a file, right-click it, choose Properties, and open Digital Signatures. The signer should be SignPath Foundation. Files from anywhere else, or that have been changed, are not covered by this policy.

Signed releases include third-party open-source components that are not signed by us: ZXing.Net (Apache License 2.0) for QR codes, and, in the standalone download, the .NET runtime (MIT License), which is signed by Microsoft.

Team roles

• Committers and reviewers: Nick Morphis. Committers can change the source code. Every change from anyone else, such as a pull request, is reviewed by a reviewer before it is merged.
• Approvers: Nick Morphis. An approver approves each release before it is signed.

All team members use multi-factor authentication for GitHub and SignPath. The current list of people with write access is on GitHub.

Privacy

DeskAuth never sends your authenticators, their names, codes or secret keys, or your passwords anywhere. It connects to the internet only:

• when you use Get icon, to the website you enter
• to check GitHub for a new version when it starts. DeskAuth asks about this the first time it opens, and you can turn it off at any time in the options menu.
• to send anonymous usage statistics, only if you agree when DeskAuth first opens. You can change this at any time in the options menu.

See the privacy notice for details. The third-party components above don't connect to the internet.

Reporting a problem

If you think a signed file has been misused, or you have found a security problem, email security@deskauth.com. See the security policy.