diff options
Diffstat (limited to '')
| -rw-r--r-- | src/content/docs/appendix/code-binary-verify.md | 41 |
1 files changed, 35 insertions, 6 deletions
diff --git a/src/content/docs/appendix/code-binary-verify.md b/src/content/docs/appendix/code-binary-verify.md index c585449..4ff95ae 100644 --- a/src/content/docs/appendix/code-binary-verify.md +++ b/src/content/docs/appendix/code-binary-verify.md @@ -2,7 +2,7 @@ title: Code & Binary Verify --- -To enhance the security and integrity of software distribution, it's crucial for +To enhance the security and integrity of software distribution, it’s crucial for developers and users alike to employ methods for verifying the authenticity and integrity of code and executable files. The process outlined below aims to fortify trust in software distribution by leveraging digital signatures and @@ -18,13 +18,40 @@ interference. The exact commands and environment configurations used during the compilation are documented within the project's `.github/workflow/release.yml` file, allowing for full accountability and reproducibility. -## Binary File Verification +## Platform-Specific Binary Signing From version 1.0.5 onwards, I sign our packages containing the binary executable files with a GPG key to further ensure security. Each package is accompanied by a signature file in the release section (with a `.sig` suffix), allowing users to verify the package before use using standard GPG tools. +All official binary releases are signed with a GPG key, providing a baseline +level of cross-platform integrity and authenticity verification. In addition to +GPG signatures, each platform incorporates its own native code signing and +verification mechanisms, as outlined below: + +### Windows + +All executable files (.exe, .dll) and installer packages are signed using a +Certum code signing certificate. The signature is trusted by Windows and can be +verified through standard Windows mechanisms (e.g., file properties or +signtool). + +### macOS + +All application bundles and binaries are signed with an Apple-approved developer +certificate (codesign). Each official release also passes Apple Notarization, +ensuring the package’s integrity and compliance with Apple’s security standards. +Gatekeeper will automatically verify these protections on first launch. + +### Linux + +AppImage packages are provided with a GPG signature file (with a .sig suffix) in +the release section. Users are encouraged to verify the authenticity and +integrity of the package using the provided GPG public key before installation +or execution. For Flatpak and other formats, the platform’s own signature and +sandboxing mechanisms offer additional security. + ## Build Info Verification Our software includes an "About" interface accessible from the help menu, @@ -58,7 +85,9 @@ dbaEG0FOTKu+n4rVhBpTes93Bn2GcRSbQwA= -----END PGP PUBLIC KEY BLOCK----- ``` -This comprehensive approach to security, including automated builds, careful -selection of third-party libraries, and transparent verification methods, -ensures that users can trust the software they are using while also providing -the tools needed to verify that trust independently. +This comprehensive approach to security—including automated builds, +cross-platform code signing (Windows Authenticode, Apple codesign & +notarization, OpenPGP for Linux), careful selection of third-party libraries, +and transparent verification methods—ensures that users can trust the software +they are using while also providing the tools needed to independently verify +that trust. |