Code Signing Policy

Kubeli's Windows installers are signed so you can confirm they come from this project and have not been tampered with.

Signing provider

Free code signing provided bySignPath.io, certificate bySignPath Foundation.

Roles

Kubeli is maintained byatilladeniz, who acts as author, reviewer, and approver. Every release signing request is approved manually before the certificate is applied. Contributions arrive as pull requests and are reviewed before merge.

What gets signed

Only the official Windows release artifacts are signed: the NSIS installer (Kubeli_*_x64-setup.exe) and the MSI package (Kubeli_*_x64_en-US.msi). Artifacts are built by GitHub Actions directly from the source in this repository and submitted to SignPath from that workflow only.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user.

Verifying a download

On Windows, check the signature with PowerShell:

Get-AuthenticodeSignature .\Kubeli_*_x64-setup.exe

The status must be Valid and the signerSignPath Foundation. You can also right-click the file → Properties → Digital Signatures.

Source

Kubeli is open source under the MIT license. The build and signing workflow lives in.github/workflows/publish.yml.