security & code signing

Code Signing

How official PartialFKR releases are built, signed, and verified — and how to know that what you downloaded is genuine.

How releases are built

Every official release is built automatically by GitHub Actions from the public source at github.com/ideocentric/partialfkr. Binaries are not built or uploaded from any developer's personal machine. The workflow that produces each platform's package is itself part of the source tree (.github/workflows/release.yml), so the exact build steps are open to inspection.

Signing status by platform

macOS

Signed & notarised

Signed with an Apple Developer ID certificate and notarised by Apple. The .dmg runs without Gatekeeper warnings.

Windows

Signing via SignPath

Authenticode signing through the SignPath Foundation is being enabled. Until reputation accrues, SmartScreen may still warn on first run.

Linux

Unsigned (standard)

DEB and RPM packages are distributed unsigned, as is normal outside a distribution's own repositories.

Windows Authenticode signing

Official Windows builds of PartialFKR are Authenticode-signed via the SignPath Foundation, which provides free code signing for open-source projects. Both the application binary and the installer are signed as part of the automated GitHub Actions build.

Signing keys are held by SignPath and are never exposed to maintainers or to the build machine. A valid signature confirms the binary is an unmodified, automated build of the published source — not that any individual vouched for it by hand.

SmartScreen on Windows

Microsoft SmartScreen builds “reputation” for a signing identity gradually, as more people download and run a binary without flagging it. A newly signed application may therefore still trigger a “Windows protected your PC” prompt for a while. This is expected and does not indicate a problem. To proceed, choose More info → Run anyway — but only for installers downloaded from the official release page below.

Verifying what you downloaded

Download only from the official GitHub Releases page (linked from this site).
On Windows, right-click the installer → Properties → Digital Signatures to inspect the certificate once signing is live.
On macOS, the app is notarised; Gatekeeper verifies it automatically on first launch.

Reporting a security issue

Please report suspected vulnerabilities privately through the GitHub security advisory form rather than in a public issue.