Legal
Code signing policy
Free code signing on Windows is provided by SignPath.io, certificate by SignPath Foundation.
Status: signing through SignPath is planned and not running yet. Until it starts, the Windows installer is unsigned and Windows shows a warning the first time you run it (see the first time you open it). This page sets out how signing will work.
What is signed
The Windows installer of the LOAM desktop app (LOAM-win-x64.exe). Signing lets Windows
show who published the file and lets you check that it has not been changed since it was built.
Once signing starts, the signer name will read SignPath Foundation. LOAM is published by
Magic Zebra Ltd.
How builds are made
Signed files will be built only by the
build-desktop GitHub Actions workflow
in the public repository
MagicZebraLtd/loam, from a tagged
release commit. The workflow will upload the unsigned installer as a build artifact and submit it to
SignPath, which checks that the file came from that repository and workflow before signing.
Release files are never built or signed on a personal computer. Every release file already carries a signed build
record you can check with gh attestation verify (see verify your download).
Team roles
- Committers and reviewers: the maintainers of MagicZebraLtd/loam, who review every change before it is merged.
- Approvers: the owners of the MagicZebraLtd organization. Each signing request will need an approver to approve it by hand before anything is signed.
Privacy
The software sends no information to any server of ours. It talks only to the local network it serves, with three exceptions. When the person using it taps Check for updates, it asks GitHub's releases API for the latest version number; it never checks on its own. If the host links it to another LOAM network, the two exchange public channels, their messages and their authors' names, wherever that network is; direct messages and private channels never leave. And if the host turns on an online assistant, which the admin page warns about, the messages people write to the assistant go to that service. See the full privacy policy.
Reporting a problem
If you think a file signed under this policy is malicious or has been tampered with, do not run it. Email opensource@magiczebra.co.uk with the file's SHA-256 and where you got it, or open an issue.