Code signing policy

Effective and last updated: August 18, 2026

Signing service and scope

Current releases are unsigned.

This policy covers official Windows release builds of StreamDecky.exe published through GitHub Releases. The ZIP archive is accompanied by a SHA-256 checksum. The executable inside the archive is the artifact whose signing status is reported; ZIP archives themselves are not Authenticode-signable.

Each release's notes state its actual signing status and are authoritative for that release. The policy will be updated if the release signing status or process changes.

Project roles

Contributions from people without commit access are reviewed before they are merged. Release publication is controlled by the project maintainer. Multi-factor authentication is required for accounts with source-control access.

Source and build provenance

Official releases are built from the public StreamDecky repository by the checked-in GitHub Actions release workflow on GitHub-hosted Windows runners. The workflow restores declared dependencies, runs the test suite, publishes the self-contained Windows executable, records the actual signing status, packages the release, and produces a SHA-256 checksum. Only artifacts originating from this automated release workflow are published as official releases.

Privacy

StreamDecky's network communication and local data handling are documented in the StreamDecky privacy policy.

Reporting concerns

Report suspected signature misuse, compromised releases, or policy violations through the project issue tracker.