Code signing policy

Signing

PlexusTerm will be signed through the SignPath Foundation programme for open-source projects. Until then, the Windows installers are not signed: check each download against the SHA-256 checksums published with every release.

Code signing will be provided free by SignPath.io, with a certificate by SignPath Foundation.

What is signed

Only the Windows installers (.msi and -setup.exe) built by the release workflow on GitHub Actions from the tagged source of the PlexusTerm repository. The workflow and the build scripts are part of that repository and are reviewed like the rest of the code.

Libraries that PlexusTerm bundles from other open-source projects are not signed by PlexusTerm, and no binary built anywhere else is signed.

Team roles

Committers and reviewers: Jorge Alonso.

Approvers: Jorge Alonso, who approves each signing request.

Changes from other contributors are reviewed before they are merged.

Privacy

PlexusTerm connects only to the servers you connect to; to GitHub, once at start, to check for a newer release (Settings → About turns it off); and, when you use its AI features, to the AI provider you set up (with OpenCode Go, also to its public model list and models.dev). It has no analytics or telemetry.

How this website handles data is described in its privacy policy.