Code signing policy

Last updated: 16 October 2026 · (application pending)

Zerava Technologies Inc. publishes free, open-source tools for Windows and Ubuntu. For the Windows builds we use the code signing service that SignPath Foundation offers to open-source projects, under its conditions. This page is the policy those conditions ask for: how a build comes to exist, who may change the code, who approves a signature, and what the program does with your data.

Application to SignPath Foundation pending. This page exists so the policy is public before the review; the wording changes to the present tense when the application is accepted.

Code signing policy: PSE Analyzer (application pending)

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Windows downloads of PSE Analyzer are built by GitHub Actions directly from a tagged commit (for example v0.3.2) in the project’s public source repository. Once SignPath Foundation accepts the application, each build will be signed only after a maintainer approves that specific build. The signature will then confirm that the file you downloaded is the result of an automated build of that published source. public source repository · the published releases.

Team roles

  • Authors, may change the source code in the project’s repository: Andrej Ristić, Dhiraj Sah.
  • Reviewers, every change proposed by someone who is not an author is reviewed by a team member: Andrej Ristić, Dhiraj Sah.
  • Approvers, each signing request is approved by a maintainer trusted to decide whether a release may be signed: Andrej Ristić, Dhiraj Sah.

Privacy

PSE Analyzer will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. Analysis runs entirely on your own computer, results are sealed in a dossier on that computer, and the web interface listens on 127.0.0.1 only. The optional chat feature contacts a language-model provider only after you configure one with your own API key, and sends only the text you submit; that provider’s privacy policy applies to what you send it. See also our privacy policy.

What the signature proves, and what it does not

A signature ties a file to this policy: the file was produced by our automated build from the tagged source named above and was approved by one of the people listed. It does not change what the program does, and it is not a judgement of the program’s quality. The checksum published beside every file remains the way to verify a download you already have, signed or not.

Questions

Write to info@zeravatech.ca. Security concerns about our software go through the Security page.