Code signing policy
Who signs PortDock release files, and how.
Status: application planned / applies after approval
PortDock has not been approved by SignPath Foundation yet, and the files currently released are not signed. The statement and process below apply to releases made after approval. Until then Windows may show «Windows protected your PC» — please verify files as described under «Is it safe?» on the download page.
(planned / after approval) Free code signing provided by SignPath.io, certificate by SignPath Foundation
What is signed
- Only PortDock's own programs (the exe files in the installer, offline installer and portable editions). Files from other projects are never signed.
- Only files built by GitHub Actions (release.yml) from the source in this repository (github.com/portdock/PortDock). Files built on a personal PC are never signed.
- Every release must be reviewed and approved by an approver before it is signed.
Team roles
PortDock is currently developed by a single maintainer, who holds all three roles. Members are listed in the GitHub organisation portdock people. All members must use multi-factor authentication for GitHub and SignPath.
- Authors — may modify the source code without additional review: the maintainer
- Reviewers — review every change proposed by non-committers (pull requests): the maintainer
- Approvers — approve each signing request: the maintainer
Privacy
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
In practice:
- Device communication (serial, TCP, UDP, Modbus, SCPI, network device discovery) goes only to the ports, addresses and subnets you choose.
- Traffic, command lists, rules and settings stay on your PC. The programs never check for updates on their own (the button opens the release page in your browser).
- Error reports are sent to the error-tracking service Sentry only when you press send in the «!» report window, or set «Automatic error reports» to «Send automatically» in settings. The default is «Ask after a crash», so even after a crash nothing is sent without your permission; «Never send» turns it off.
- If Microsoft Edge WebView2 is missing, the installer downloads it from Microsoft (the offline installer and portable edition do not).
Details: privacy policy · Third-party services and components: Sentry privacy policy (when you send an error report), Microsoft privacy statement (WebView2)