Code signing
Code signing policy
How the Comitiva installers are built and signed, who approves each signature, and what the app sends over the network on its own.
Not in effect yet. The installers are still unsigned. Windows signing waits for the SignPath Foundation to accept the project, and macOS signing for an Apple Developer ID. Until then, Windows SmartScreen and macOS Gatekeeper warn the first time you open Comitiva. How to get past the warning
Who signs each installer
Windows
Free code signing provided by SignPath.io, certificate by SignPath Foundation. Windows shows SignPath Foundation as the publisher.
macOS
Signed with the Developer ID of the maintainer’s Apple Developer Program membership, and notarized by Apple.
Linux
The AppImage, deb and rpm are not signed. The download page lists the SHA-256 of every file.
What gets signed
- Only the installers that the release workflow builds from a version tag of the public comitiva repository, on GitHub’s runners. Nothing built on someone’s own computer is signed.
- They contain the desktop app, its runner and its built-in MCP servers: the repository’s own Apache-2.0 code and its open source dependencies.
- Every signing request is approved by hand, by one of the approvers below.
Team roles
- Committers and reviewers
- Members of the comitiva-dev organization on GitHub
- Approvers
- Oscar Dias (@oscardias)
Privacy
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
Comitiva talks to what you set up: the LLM providers of your connections, the MCP servers and Google Drive you add, and a hub if you sign in to one. API keys stay in your system’s keychain.
On its own, it checks GitHub Releases for a new version 10 seconds after it starts and every 6 hours. Settings → Updates turns this off.