Code signing policy

Status

Code signing through the SignPath Foundation program for open-source projects is planned and pending approval. Until it is approved, Kyro releases are not code signed (Windows SmartScreen shows a warning; see First launch). Automatic updates are signed separately with Kyro's update key and checked by the app. This page applies as soon as signing is active.

What is signed

Only release builds of Kyro Wallet built by the public GitHub Actions release workflow of github.com/shuntraa/kyro-wallet, from a version tag, from the source code in that repository. Nothing built on a personal computer is signed, and the certificate is never used to sign anything else: no third-party software, no other project, no modified builds.

Team roles

• Committers and reviewers: shuntraa (maintainer).
• Approvers (each signing request is approved by hand): shuntraa.

Every change to the repository goes through the maintainer.

Privacy

Kyro collects no personal data and transfers no information to other networked systems unless you ask for it: the blockchain, price and swap requests you trigger go to the providers listed in NETWORK.md, over Tor by default. See the privacy policy.

Report a problem

If you find a signed file that does not come from this project's release workflow, report it through GitHub security advisories.