Signed where it is built, in public.

What is signed

• The installer, kryfo-<version>-windows-x64-setup.exe
• kryfo.exe
• halo.dll, the engine
• kryfo_signal.dll, the libsignal shim
• sqlcipher.dll
• The plugin DLLs built from source with the app

The zip of the app folder holds the same signed files as the installer.

What we do not sign

• tor.exe and the files next to it are the Tor Project's own binaries from the Tor expert bundle. They are pinned by SHA-256 and shipped unmodified, and the engine starts no other tor.exe.
• flutter_windows.dll is the Flutter engine as Google ships it, also unmodified.

How a release is signed

• Only tagged releases are signed, and only files built in public on GitHub Actions from the Kryfo repository, by its Windows workflow.
• SignPath checks that the files come from that workflow run on GitHub's own machines. What may be signed is listed in the repository, in packaging/windows/signpath.
• Every signing request is approved by hand before anything is signed.
• There is no local signing. No signing key is on a developer's computer, and nothing built elsewhere is signed.

A signature says a file was built from this source, in public. It does not say the code has been reviewed: the threat model says what Kryfo protects against, and what it does not.

Team

• Committers and reviewers: GnosiWorks
• Approver: Marios

Everyone in these roles uses multi-factor authentication on GitHub and SignPath.

Privacy

Kryfo collects nothing about you and sends nothing about how you use it to us. It connects to Tor and to the relays and services that deliver your messages, and only for that. What each of them can see is in the privacy policy.

Something looks wrong?

A signed file that does not match a release, or anything else wrong with signing: tell me privately. The same policy is in the repository as CODE_SIGNING.md.