Code signing policy
Status: Windows installers are not code-signed yet. SignPath Foundation, which signs open source projects for free, asks for more public visibility than Snap2Link has today, and the project will apply again later. Until then, Windows SmartScreen may show an "unrecognised app" warning: choose More info, then Run anyway. This page will name the first signed version and who signs it.
Every release is still built in the open by GitHub Actions from this repository, and every update is checked by the app against Snap2Link's own updater key before it installs.
What will be signed
-
The Windows installer,
Snap2Link_<version>_x64-setup.exe, published on the GitHub releases page and through winget. - Only installers built by the GitHub Actions workflow of amys94fr/Snap2Link, from the source code at the release tag, on GitHub-hosted runners. Nothing built elsewhere is sent for signing.
- The installer's product name must be Snap2Link and its version must match the release, or the signing is refused.
macOS and Linux packages are not covered by this certificate. Every update, on every platform, is also checked by the app against Snap2Link's own updater key before it installs.
Team roles
Changes from anyone else arrive as pull requests, which a committer reviews before they are merged.
The main branch only accepts changes through pull requests that pass the tests. Every
signing request is approved by hand on SignPath. All team members use multi-factor authentication
on GitHub and SignPath.
Privacy
Snap2Link only sends data to the services you choose, and to the few it needs to work:
-
Your captures go to the host you pick in the setup wizard: Snap2Link hosting at
i.snap2link.app, or your own Google Drive. - Signing in to a Snap2Link account goes through a code sent by email, or through Google if you choose it.
- Before the first upload without an account, a Cloudflare Turnstile check runs once.
- The app checks GitHub for updates.
The privacy policy lists what each of them receives and how long it is kept. The app sends no telemetry and no analytics.
Report a problem
If you think a file signed for Snap2Link is not what it claims to be, write to contact@snap2link.app. You can also report it to SignPath at support@signpath.io.