CODE SIGNING POLICY

How releases are built, approved and signed, and what the program does with your data.

Status: the releases published so far are not code-signed. The project meets the conditions for the free open source signing programme of SignPath Foundation and is applying to it. The rules below are the policy that applies once signing is active; this page will say so when it is.

Attribution

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Signed files show SignPath Foundation as the publisher: in Explorer, right-click RoboXCopy.exe, choose Properties, tab Digital Signatures. The program itself is written and maintained by Cristian Castellari (see below), not by SignPath Foundation.

What is signed

Only the binaries of this project, RoboXCopy.exe (and the installer, if one is published), built from the source in github.com/Skyflash/RoboXCopy.
Third-party libraries used by the program are open source crates compiled into the exe; nothing proprietary is included.
Product name Robo-XCopy and a single product version are set in the file metadata of every build.

How a release is made

Changes are committed to the public repository. The build script and the release workflow (.github/workflows/release.yml) are part of that source and are reviewed like any other change.
A version tag (vX.Y.Z) starts the release workflow on GitHub-hosted runners: tests, build, checksum.
The workflow sends the unsigned RoboXCopy.exe to SignPath, which checks that it comes from this repository's automated build.
The approver below approves each signing request manually.
The signed file is published as a GitHub release together with its SHA-256 and a GitHub build attestation (gh attestation verify RoboXCopy.exe --repo Skyflash/RoboXCopy).

Roles

Role	Who	What they do
Authors (committers)	Cristian Castellari	Write the code and the build scripts.
Reviewers	Cristian Castellari	Review changes proposed by anyone who is not a committer.
Approvers	Cristian Castellari	Approve every signing request.

All team members use multi-factor authentication on GitHub and on SignPath. If more people join, they are added here.

Privacy policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Robo-XCopy has no telemetry, no update check and no account. It runs the Windows robocopy tool on your files and shows its output.
The only network action is opening a web page in your browser when you press HOW-TO ONLINE or PROJECT PAGE in the HELP window.
The program stores one small file, %APPDATA%\RoboXCopy\theme.txt (the theme you chose), and writes the log file only where you tell it to.
This website does not use cookies or analytics. The home page asks the public GitHub API for the number of downloads from your browser, and stores the answer in your browser for an hour.

Reporting a problem

If you think a signed file is not what this policy describes, tell us on GitHub issues; we will investigate and help find the root cause. SignPath Foundation can also be reached at support@signpath.io.

BACK DOWNLOAD