Skip to content
§ DS2000 — Code signing policyUpdated 17 Oct 2026

Code signing policy

How the DS2000 Windows installer is signed, who can sign it and how to check a signature.

Who signs

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Releases up to and including v0.2.0 are not signed. Signing applies from the first release after the project's application to SignPath Foundation is approved.

What is signed

Only files built from the public Mechanix97/DS2000 repository:

  • The Windows installer, DS2000_<version>_x64_en-US.msi, attached to each release.
  • The app's executable, DS2000.exe, inside it.

Third-party libraries are compiled into the app from source; no third-party binary is signed under this certificate. Device firmware is not signed with it either: firmware images are signed with the project's own minisign key (minisign.pub in DS2000-Firmware), and the app refuses images that do not match it.

How a release is signed

  • A version tag on the repository starts the release workflow on a GitHub-hosted runner. Nothing built on a developer's computer is signed.
  • The workflow builds the installer from the tagged source and submits it to SignPath.
  • An approver checks the request and approves it by hand. No release is signed automatically.
  • The signed installer is attached to a draft release, which is published only after it has been checked.

Team roles

Every member uses multi-factor authentication on GitHub and on SignPath.

  • Committers and reviewers: Mechanix97. The main branch is protected: changes reach it only through pull requests whose checks pass.
  • Approvers: Mechanix97.

Privacy

The app only connects to the services listed in the privacy policy, and none of them belongs to Mechardo Labs. It collects no telemetry.

Checking a signature

Right-click the downloaded .msi, choose Properties and open Digital Signatures; the signer must be SignPath Foundation. In PowerShell:

Get-AuthenticodeSignature .\DS2000_*.msi | Format-List

If you find a signed file that was not built from this repository, or a signed release that misbehaves, report it through GitHub issues or the contact form.