Grimoire

Code signing policy

Grimoire's Windows installer is code-signed so that Windows can verify who built it and that it hasn't been tampered with.

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

Only the Windows installer (Grimoire-Setup-<version>.exe) and the Grimoire application executable inside it, built from the source code in the repository by the Release workflow on GitHub-hosted runners. Nothing built anywhere else is submitted for signing. Bundled third-party libraries and the Electron runtime keep their own signatures and licences. Linux packages are not signed with this certificate; their checksums are published with each release and verified by the auto-updater.

Team and roles

  • Author (can change the source code): @itsdommie
  • Reviewer (reviews every outside pull request before it is merged): @itsdommie
  • Approver (approves each signing request, checking it comes from the Release workflow for a tagged version): @itsdommie

All team members use multi-factor authentication for GitHub and for SignPath.

How a release is signed

  1. A maintainer tags a version, which must match the version in packages/desktop/package.json.
  2. The Release workflow builds the installer on a GitHub-hosted runner, runs the automated tests, and smoke-tests the built app.
  3. The unsigned installer is submitted to SignPath from that workflow run, which records the repository, commit and run it came from.
  4. The approver approves the request only if it matches a tag they created.
  5. The signed installer replaces the unsigned one, the auto-update checksum file is regenerated for it, and the release is published.

Privacy

Grimoire does not collect, store or transmit personal data about its users. It has no accounts, analytics or telemetry. Your decks and collection stay on your computer. The app contacts only: Scryfall (card data and images), Wizards of the Coast (the Comprehensive Rules text), GitHub (checking for new versions; can be turned off in the Help menu) and, once and only if you turn on semantic search, Hugging Face (a language model download). Code signing itself involves no user data.

Reporting a problem

If you believe a Grimoire release is malicious or was signed in error, open an issue, or use GitHub's private vulnerability reporting for security problems.