Code signing policy

Signed builds, verified sources.

Current status

Windows code signing is in progress. The Windows CLI and desktop executables in the current releases are not code signed yet.

Release builds of the macOS desktop app are signed with an Apple Developer ID and notarized. Linux builds are not code signed.

Signing provider

The project is seeking free code signing from SignPath.io, with a certificate from the SignPath Foundation. This is not active yet.

Scope

This policy covers the Windows executables built from this repository:

• onley.exe, the command-line client
• Onley.exe, the desktop client

The macOS desktop app is signed with an Apple Developer ID and notarized. This policy covers the Windows signing request.

Build and provenance

• Source: github.com/fdaio/onley
• License: MIT
• Builds: GitHub Actions, .github/workflows/release.yml, tag v*
• Only artifacts built from the tagged commit in that workflow are eligible for signing. Local builds are not signed.
• The desktop build sets the product name and version from cmd/onley-app/nsh.json. Release assets use the tag as their version. The CLI binary does not embed version metadata.

Roles

• Committers and reviewers: repository contributors, including @Laotree.
• Approvers: @Laotree, repository owner.
• After signing is active, every signing request needs manual approval by an approver after the release candidate passes CI.

Signing process after approval

1. A v* tag starts the release workflow.
2. CI builds the Windows CLI. The Windows desktop app builds from source on Windows.
3. The Windows executables are submitted to SignPath.io.
4. An approver reviews the signing request.
5. SignPath signs the executables, and the workflow packages the signed files.
6. The release publishes the signed assets and checksums.

Privacy

Onley runs locally. It has no telemetry and does not transfer information to other systems unless the user runs serve or replica, or otherwise requests a network operation. The client reads the local index at ~/.onley/local.db and the folders the user selects. See the privacy policy.

Contact

Open an issue at github.com/fdaio/onley/issues.

Last updated: October 29, 2026