ChainShotCode signing policy
Status: Windows executables are not code-signed. SignPath Foundation, which gives free certificates to open source projects, asks for an established community: ChainShot will apply again later.
If a certificate is granted, Windows releases of ChainShot will carry this statement: Free code signing provided by SignPath.io, certificate by SignPath Foundation.
What is signed
ChainShot.exe, from the chainshot-app-<version>.zip release asset. It is built from
the public repository github.com/Dalkin69/chainshot by the
GitHub Actions release workflow; only binaries built from this project's own source code are signed.
The browser extension is signed by the browser stores; chainshot.py and the PowerShell module are
distributed as source.
Team and roles
| Role | Members | Responsibility |
|---|---|---|
| Committers and reviewers | Dalkin69 | Write and review every change; changes from outside contributors are reviewed in pull requests before they are merged. |
| Approvers | Dalkin69 | Approve each signing request by hand, for a release built by the official workflow. |
All team members use multi-factor authentication for GitHub and SignPath.
Privacy
ChainShot collects no data and has no telemetry. The only network request it makes is the RFC 3161 timestamp that the user asks for, which sends the SHA-256 of a seal file to the time-stamp authority the user chose. See the privacy policy.
System changes and uninstallation
ChainShot runs without installation and without administrator rights. It changes the system only when the user
asks: a Start menu shortcut, start with Windows, and the browser link (after a question at first start). It then lists
itself in Settings > Apps > Installed apps, from where it is removed like any other program (or
Options > Uninstall from this computer, ChainShot.exe uninstall): everything it added is
removed and the executable can be deleted. Case folders are never touched.
Verify a download
Compare the SHA-256 of the zip with SHA256SUMS.txt in the release:
Get-FileHash chainshot-app-v1.3.2.zip. Once signed, the signature is visible in the file
properties of ChainShot.exe (Digital Signatures tab) or with Get-AuthenticodeSignature.
Report a problem
If a ChainShot file behaves suspiciously, do not run it: report it with its SHA-256 and where you downloaded it, privately through GitHub security advisories.