Thought DeskCode Signing Policy
Last updated October 25, 2026
In short
- Free code signing provided by SignPath.io, certificate by SignPath Foundation.
- We sign only what our release workflow on GitHub builds from Thought Desk's public source code, and each release is approved by hand.
- Signing starts with the first release after SignPath Foundation accepts the project. Releases before that aren't signed.
What we sign
Each Windows release: the installer (Thought.Desk_x.y.z_x64-setup.exe), the app inside it (thought-desk.exe) and the uninstaller it puts on your computer. The updates the app installs by itself are the same signed installer.
The installer also unpacks a few small helper files that come with NSIS, the open-source installer system it's made with. We include them as their makers publish them and don't sign them.
How releases are built and signed
- Every release is built by GitHub Actions from the public repository, kusule1351-hue/thought-desk, by the release workflow (
.github/workflows/release.yml). Nothing we release is built on anyone's own computer. - Before it signs anything, SignPath checks that the files were built by that workflow, from that repository.
- Each signing request is approved by hand, by an approver listed below, after checking what's in the release.
- The certificate's private key is kept by SignPath in a hardware security module. Nobody working on Thought Desk has a copy.
- Updates also carry a second signature, made with Thought Desk's own update key. Installed copies install only updates that have it.
Team roles
- Committers and reviewers: Kusule, who writes and reviews the code. Changes from anyone else are reviewed before they're merged.
- Approvers: Kusule, who approves each signing request.
Everyone in these roles must use two-factor authentication for GitHub and SignPath.
Check a file
Right-click the installer, choose Properties, then the Digital Signatures tab. A signed release names SignPath Foundation as the signer, since Windows shows who holds the certificate rather than the app's name. In PowerShell, Get-AuthenticodeSignature followed by the installer's name should say Valid.
Privacy
The app goes online only as our Privacy Policy describes: to check for updates, to load pictures you add from the web, and for the online features you choose to use. Signing doesn't change that.
Report a problem
If you find a file signed with this certificate that doesn't come from Thought Desk's releases, or a release that looks wrong, don't run it. Email support@thoughtdesk.org with where you got it and its SHA-256 hash (Get-FileHash in PowerShell shows it). We'll look into it, and ask SignPath to revoke the signature if it's misused.