Releases
Code signing policy
How TrackMy Sign releases are built and signed. The macOS app is signed with an Apple Developer ID and notarized by Apple. The Windows installer is not code-signed yet.
- What is signed
- macOS: the app in TrackMySign-macos-universal.dmg is signed with the Developer ID of TrackMy Tech Private Limited and notarized by Apple. Windows: the installer (TrackMySign-Setup-windows-x64.exe) and command-line tool are not code-signed yet; the Microsoft Store package is signed by Microsoft when it is published. In-app updates for all platforms are signed with the project's update key and checked by the app before installing. All files are published on the GitHub releases page with SHA-256 checksums.
- How binaries are built
- Every release is built by GitHub Actions directly from the public source in github.com/rahuldk1105/trackmysign. No binary is built or signed on a personal machine.
- Committers and reviewers
- DK Rahul (@rahuldk1105)
- Approvers
- DK Rahul (@rahuldk1105), repository owner, who approves every release.
- Privacy policy
- This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. TrackMy Sign signs PDFs locally with the user's DSC token; documents and PINs never leave the computer, and the app has no analytics or telemetry. The only network requests are an update check against GitHub Releases (can be turned off) and, when the user switches them on, a timestamp request (a hash only) and certificate revocation checks (OCSP/CRL).
- Third-party components
- The app talks only to the token driver (PKCS#11 library) installed by the token's vendor, on the same computer. It bundles open-source libraries (Tauri, PDF.js, RustCrypto) that make no network requests of their own in this app.
- Reporting problems
- Report a suspicious or incorrectly signed binary by opening an issue at github.com/rahuldk1105/trackmysign/issues.