# Code signing policy

Effective date: 2 November 2026 · Last updated: 2 November 2026 · Version: 1.0

Page: https://blame.so/code-signing-policy

This policy describes how Blame's releases are built and signed, who may approve a signature, and where to find what the app sends. The same policy is kept in the source repository at https://github.com/rchrp/Blame/blob/main/CODE_SIGNING_POLICY.md.

## 1. Windows

> **Pending**
>
> Blame has applied to SignPath Foundation for free code signing for open-source projects. Until the application is approved, the Windows installer is not signed and Windows SmartScreen may warn about it.
>
> Once approved, Windows releases will carry this attribution: Free code signing provided by [SignPath.io](https://about.signpath.io), certificate by [SignPath Foundation](https://signpath.org).

## 2. What is signed

- Windows: Blame.exe, the application, and blame-win-x64.exe, its installer.
- macOS: the application and its runtime helpers, signed with an Apple Developer ID certificate and notarized by Apple.

Only files built from Blame's source are signed. Third-party binaries that Blame ships unchanged, such as Electron's libraries, ripgrep, node-pty's helpers and pnpm, keep their upstream signature or none.

## 3. How releases are built

Every release is built from a tag in the public repository https://github.com/rchrp/Blame by GitHub Actions on GitHub-hosted runners. No release is built or signed on a personal machine. For Windows, the release workflow sends the unsigned files to SignPath, and an approver approves each signing request by hand before they are signed. The release process is described at https://github.com/rchrp/Blame/blob/main/RELEASING.md.

## 4. Team roles

- Committers and reviewers: [Raphael Charpentier](https://github.com/rchrp)
- Approvers: [Raphael Charpentier](https://github.com/rchrp)

Contributions from anyone else arrive as pull requests, which a reviewer checks before they are merged. Every team member uses multi-factor authentication on GitHub and SignPath.

## 5. Privacy

The privacy policy at https://blame.so/privacy describes the data Blame sends, where it goes and how to turn it off. The Windows installer shows a summary of it before installing and lets you turn off usage telemetry and the update check at launch; Settings > Desktop > Privacy offers the same switches.

## 6. Reporting a problem

To report a signed file that you believe is malicious or misattributed, write to security@blame.so.