Code signing policy.

Status

Cobble installers are not signed yet, so Windows shows an unknown publisher warning when you run one. Cobble plans to use the free code signing program for open source projects from the SignPath Foundation. This page describes how signing will work once it is approved.

Attribution

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What gets signed

• Only the Windows installer, built from the source code in github.com/Kayzlawg/cobble.
• Only builds made by the project's GitHub Actions workflow, never a build made on a personal computer.
• The installer bundles yt-dlp, ffmpeg and Deno. These come from their own projects and are not built by Cobble.

Team roles

Cobble has one maintainer, Kayzlawg. They are the author, reviewer and approver. Contributions from other people are reviewed by the maintainer before they are merged.

Every signing request is approved by hand. Everyone with access to the repository or to SignPath uses multi-factor authentication.

Privacy

The app does not collect or send your data. The details are in the privacy policy.

Reporting a problem

If you think a signed Cobble installer is not what it should be, open an issue at github.com/Kayzlawg/cobble/issues.