Code signing policy
How Dowse's Windows installer is built and signed, who can approve a signature, and what Dowse sends over the network.
Dowse's Windows releases are to be signed through SignPath Foundation's free code signing for open-source projects. A release is signed only when its release notes say so: 0.1.0 is not signed.
Who signs
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
Because the certificate belongs to SignPath Foundation, Windows names SignPath Foundation as the installer's publisher.
What is signed, and how
- Only the Windows installer, Dowse-Setup-<version>.exe, published on GitHub releases.
- It is built by GitHub Actions (the Windows workflow) from the source in the public repository, never on a personal machine. The build scripts and the CI configuration are part of that source.
- Every signing request is approved by hand by an approver (below), one release at a time.
- The installer carries the product name Dowse and the release's version number.
- Components inside it that come from other projects (Python and the open-source libraries Dowse uses) keep their own maintainers' signatures, or none; this certificate doesn't sign them.
Team and roles
| Role | Who | Responsibility |
|---|---|---|
| Committers and reviewers | WalidHadri-Iron | Change the source; review every contribution from anyone else before it's merged. |
| Approvers | WalidHadri-Iron | Approve each signing request. |
Every team member uses multi-factor authentication on GitHub and on SignPath.
Privacy policy
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
Dowse reads and searches your files on your PC. It has no account, no telemetry and no update check. It goes online only for these downloads, which you start:
- The model, from Hugging Face, when you choose one at setup or switch models. Hugging Face's privacy policy applies to that download.
- The runtime (llama.cpp), from its releases on GitHub, at setup or when you switch device. GitHub's privacy statement applies to that download.
- Microsoft Edge WebView2, which shows Dowse's window, is part of Windows. If it's missing, the installer installs it from Microsoft. Microsoft's privacy statement applies to WebView2.
Changes to your PC
- Dowse installs for your Windows user only, without administrator rights, with a Start menu shortcut (and, if you tick it, one on the desktop).
- It adds Dowse to Explorer's right-click menu and to Send to, so you can add files to it from Explorer. Settings › Explorer's right-click menu turns it off.
- It starts with Windows unless you turn that off: the switch is on the first-run screen, and in Settings.
- It adds new screenshots only if you turn that on in Settings.
- Uninstalling (Windows Settings › Apps) removes all of these. It asks whether to also delete Dowse's index, downloaded model and settings. Your own files are never changed, moved or deleted.