Skip to content

Code Signing Policy

openstan installers are code-signed to verify authenticity and integrity.

  • Windows: signed with a Certum Open Source Code Signing certificate using jsign.
  • macOS: signed with an Apple Developer ID Application certificate, notarized by Apple, and stapled.

Scope

Windows

Windows installers (.msi) for openstan are code-signed using a certificate issued to Open Source Developer Jason Telford Farrar by Certum Code Signing 2021 CA (Asseco Data Systems S.A.).

The certificate is an OV (Organisation Validation) Open Source Code Signing certificate stored in Certum's SimplySign cloud-based virtual smartcard.

The signature covers the MSI installer package. It confirms that the installer was produced by an automated, verifiable build from the source code in this repository.

macOS

macOS builds (.app inside .dmg) are signed with an Apple Developer ID Application certificate. The signed app is submitted to Apple's notarisation service, and the notarisation ticket is stapled to the bundle before the DMG is created.

This means Gatekeeper will trust the application on double-click — no right-click workaround is required.

Team roles

This is a solo open-source project. All roles are held by the project maintainer.

Role Member Responsibilities
Committer Jason Farrar Merges changes to master; maintains source code and build scripts
Reviewer Jason Farrar Reviews all pull requests before merge
Approver Jason Farrar Approves each release for signing

Privacy

openstan does not collect personal data. The only outbound network request is a silent update check on startup (HTTPS to api.github.com; no personal data transmitted). Users can disable this in the application settings.

Full details: Privacy Policy

Build and release process

  1. A version tag (e.g. v1.0.0) is pushed to the GitHub repository.
  2. The GitHub Actions release workflow runs automatically:
  3. Dependencies are installed via uv sync
  4. The application is frozen with cx_Freeze

Windows

  • The MSI installer is compiled with WiX v4
  • The unsigned MSI is attached to the GitHub Release as a draft
  • The maintainer manually signs the MSI using jsign + SimplySign Desktop:
  • Authenticate SimplySign Desktop (requires OTP from Android app)
  • Run jsign --storetype PKCS11 --keystore ~/provider_simplysign.cfg ...
  • Re-upload the signed MSI to the draft release
  • The signed MSI is verified, then the draft release is promoted to published.

macOS

  • The .app bundle is signed with codesign (Developer ID, hardened runtime)
  • The signed .app is submitted to Apple's notary service via notarytool
  • The notarisation ticket is stapled with xcrun stapler
  • The DMG is created and signed separately

All build configuration is in the public repository. The release workflow and WiX installer source (packaging/windows/openstan.wxs) are open to inspection.

Reporting concerns

If you believe a signed openstan installer contains malware or has been signed with a compromised certificate, please report it to Certum support and open an issue on the openstan issue tracker.