Code signing policy

Every Teitunnel download is built from this repository's source by GitHub Actions, from a tagged commit, and nothing is built or signed on a personal computer. Releases are made by the release workflow (.github/workflows/release.yml) after a maintainer approves the release pull request.

How each download is signed

• macOS: signed with the Developer ID of Teispace, with the hardened runtime, and notarized by Apple.
• Windows: not yet code-signed. We're applying for free code signing for open source projects from SignPath Foundation; once it's in place, this page will say so and Windows installers will be signed with its certificate.
• Linux: the packages aren't signed by a distribution; verify them with the checksums and build provenance below.
• Updates: every update is signed with Teispace's update key, and the app refuses any update whose signature doesn't match the key built into it.

Verifying a download

Each release lists every file's SHA-256 in SHA256SUMS.txt and carries GitHub build provenance, which ties the file to the workflow run and commit that built it: gh attestation verify <file> --repo teispace/teitunnel.

Team and roles

• Committers and reviewers: the maintainers in the Teispace organization. Changes from other contributors are reviewed by a maintainer before they're merged.
• Approvers: Teispace's owners, who approve each release.

All team members use multi-factor authentication for GitHub. Only software built from this repository is signed; the cloudflared binary Teitunnel downloads is Cloudflare's own, and Teitunnel checks Cloudflare's signature and checksums before using it.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. See Privacy.