Code signing policy

ClipLink for Windows is code signed so that Windows can show who published it and warn you if a file was changed after it was built. This page says how releases are made and signed.

How a release is made

• ClipLink is open source under the Apache License 2.0. Everything that goes into a release is in the public repository.
• Release files are built automatically by GitHub Actions from the source in that repository. Nothing is built or changed by hand.
• The built files are then submitted for signing, and each signing request has to be approved by a maintainer before the file is signed. A request that doesn't match a build of the repository is not approved.
• Only the programs that ClipLink itself builds are signed: the ClipLink app and its installer. Third-party libraries that ship with the app keep their own publishers' signatures.
• Signed files are published on the releases page.

Team roles

• Committers and reviewers: the repository owner, Colour1205.
• Approvers: the repository owner, Colour1205.

Changes reach the main branch through pull requests. If more maintainers join, they will be listed here.

Privacy

• ClipLink does not send information to any server run by its developers, and it has no accounts.
• The program does not transfer any information to other networked systems unless the user specifically asks it to. What you copy goes only to devices you have chosen to pair, directly.
• This website has no cookies and no analytics. When the page loads, your browser asks GitHub's public API for the latest release, so GitHub sees that request.

Reporting a problem

If you think a signed file is wrong, or you found a security problem, please open an issue.