Code Signing Policy
How ezTerm release binaries are built, signed, and verified.
Build process
All release binaries are built automatically byGitHub Actionsfrom the tagged source code in thepublic ezTerm repository. No release artifact is built on a developer machine. Every release ships a SHA256SUMS file, and update packages are additionally signed for the in-app updater (minisign); the updater verifies this signature before installing anything.
Windows code signing
Free code signing on Windows provided by SignPath.io, certificate by SignPath Foundation.
Team and roles
- Committers and reviewers:members of the ZerosAndOnesLLC organization. All changes land on
mainvia commits or reviewed pull requests by organization members, who use multi-factor authentication. - Approvers: release signing requests are approved by the project maintainer.
Privacy
The ezTerm application does not transfer any user data to anyone. It contains no telemetry, analytics, or accounts. The only network connections it makes are the SSH/SFTP sessions the user initiates, update checks against GitHub Releases, and the optional X server component download the user can request. See the fullprivacy policy.
Reporting
To report a security concern with a signed binary, use the process in oursecurity policy.