Code signing policy

Status: murrtty has no signed release yet. It has applied (October 2026) for the SignPath Foundation's free code signing for open-source projects, through which its releases are to be signed. This page says how signing will work; once signing starts it carries SignPath's credit and each release links here.

What is signed

Release builds of murrtty: murrtty.exe in the release zip (and the installer, once there is one). Only builds made by GitHub Actions on GitHub's own runners, from a tagged commit of the public repository github.com/murr2k/murrtty, are submitted for signing, and each one is approved by hand. Every signed file carries murrtty's product name and the release's version. Nothing built on a developer's machine is signed, and no third-party binary is signed as murrtty's.

Team roles

Authors (who change the code without further review): Murray Kopit (murr2k)
Reviewers (who review changes from anyone else): Murray Kopit (murr2k)
Approvers (who approve each signing request by hand): Murray Kopit (murr2k)

Every account involved (GitHub, SignPath) uses multi-factor authentication.

Privacy policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

murrtty makes no network connections of its own. Crash reports are written to %LOCALAPPDATA%\murrtty\crash and stay there: nothing is sent anywhere. A future check for updates will be off unless turned on.

Reporting

A signed file that seems not to be murrtty's, or a security problem in murrtty, goes to the private vulnerability report, never to a public discussion.