Code signing policy

Signing

We are setting up free code signing provided by SignPath.io, certificate by SignPath Foundation, for TaskForce Desktop for Windows. Until it is in place, the Windows installer is not signed, and Windows or your antivirus may warn you before running it.

What we sign

• The TaskForce Desktop installer for Windows (TaskForce-Setup-<version>.exe), published on the download page and in the project's GitHub releases.
• It is built from the public source code of the main branch by the Desktop - Release workflow on GitHub Actions. We sign nothing built anywhere else, and only binaries built from this repository.
• The app bundles open source components from other projects (Electron, a Java runtime, PostgreSQL). They keep their own publishers' signatures, or none: we do not sign them in their name.

Team and roles

• Committers and reviewers: Pierre Michel (Miche1-Pierre). Changes from anyone outside the team come as pull requests, reviewed by a committer before they are merged.
• Approvers: Pierre Michel. Every signing request is approved by hand, release by release.
• Team members must use two-factor authentication on GitHub and on SignPath.

Privacy

What TaskForce Desktop sends, and to whom, is described in our privacy policy: it signs you in to your TaskForce account, asks GitHub whether a new version exists, and sends data to the AI providers and services you choose to connect. It sends us no usage data.

Check a download

Each file of a release shows its SHA-256 digest on its GitHub release page. On Windows, compare it with Get-FileHash TaskForce-Setup-<version>.exe in PowerShell.