Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Status, 16 Oct 2026: signing through SignPath Foundation is being set up, and no release is signed yet. Releases up to and including 0.1.0-beta.2 are not code-signed; check those by their SHA-256 in the release notes. This page changes when the first signed release is published.

What is signed

From the first signed release on, the installer (Diarist_<version>_x64-setup.exe) and the app inside it (diarist.exe) carry an Authenticode signature with a certificate issued to SignPath Foundation. Windows shows SignPath Foundation as the publisher, not Diarist or its author.
Not signed: uninstall.exe, which the installer writes during installation, and the NSIS helper libraries the installer unpacks while it runs.
Never signed by this project: the speech runtime (NeMo-Speech.cpp, published by NVIDIA) and the models, which the app downloads when you ask for them. SignPath Foundation's terms do not allow a project to sign other projects' files. The app checks each download against its published SHA-256.
Updates carry a second, separate signature: the updater checks every downloaded installer against the project's own updater key before it runs it.

How signed builds are made

Only the repository's sign-release workflow submits files for signing. It builds on GitHub-hosted runners from a commit on the main branch of github.com/ebt55/diarist; the release tag is created on that commit when the release is published.
For every signing request, SignPath checks that the files come from that workflow run, that repository and that branch, so a signed file is a build of the public source. The source includes the build scripts and the workflow files, and they are reviewed like any other change.
Nothing is signed until the approver has approved the signing request in SignPath, by hand, for each release.
The signing key is held by SignPath in a hardware security module. The project never has a copy.

Team roles

Diarist is a one-person project. Ebin (ebt55 on GitHub) holds every role. No one else has write access to the repository or a role in SignPath.

Role	What it covers	Member
Author	Changes the source code without a further review	Ebin
Reviewer	Reviews every change proposed by someone else, such as a pull request, before it is merged	Ebin
Approver	Decides whether a release is signed, and approves each signing request	Ebin

With one person in every role, these controls take the place of a second person:

Multi-factor authentication on the GitHub account and on the SignPath account.
Signed builds come only from the sign-release workflow on GitHub-hosted runners, from main; a build made on any other machine, including the author's, is never signed.
The main branch and the release tags cannot be force-pushed or deleted.
SignPath verifies the origin of every signing request, and every request is approved by hand.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Diarist has no account, no analytics, no crash reporting and no telemetry. It connects to the internet only when you press a button that says so:

Install engine, or a runtime: github.com and GitHub's download servers.
Install or Download a model: huggingface.co and its download servers, through Windows' curl.exe.
Add from URL: the address you typed.
Check for newer runtime: api.github.com.
Check for updates: GitHub (the update manifest on raw.githubusercontent.com, then the installer from github.com if you install it).

Like any download, these requests show your IP address to the server; nothing about your meetings, your computer or your use of the app is sent. If WebView2 is missing, the installer downloads it from Microsoft. The services involved have their own privacy policies: GitHub, Hugging Face and Microsoft. The full statement is the privacy page.

Checking a download

Download the installer from the releases page, or with this site's Download button, which links to the same file.
Compare its SHA-256 with the one in the release notes. In PowerShell: Get-FileHash -Algorithm SHA256 .\Diarist_<version>_x64-setup.exe.
For a signed release: right-click the file, Properties, Digital Signatures. The signer is SignPath Foundation, and Details says the signature is OK. In PowerShell, Get-AuthenticodeSignature .\Diarist_<version>_x64-setup.exe shows the status Valid and a signer starting with CN=SignPath Foundation. The installed diarist.exe (in %LOCALAPPDATA%\Diarist unless you chose another folder) shows the same.
SmartScreen can still show "Windows protected your PC" for a new release until enough people have downloaded it. That message means Windows does not know the file's reputation yet; it does not mean malware was found. For a signed release, More info shows SignPath Foundation as the publisher. If it shows "Unknown publisher" for a release this page lists as signed, do not run the file.
SignPath Foundation signs many open-source projects, so the publisher name alone does not show that a file is Diarist. The SHA-256 in the release notes does.

If a file looks wrong

If you find a file that is signed by SignPath Foundation and claims to be Diarist, but its SHA-256 is in no release's notes, or a signed Diarist file that does something the docs do not describe: do not run it. Open an issue with the file's SHA-256 and where you got it; if you would rather not post it publicly, send a private report from the repository's Security tab. You can also report it to SignPath Foundation at support@signpath.io; their terms describe how they investigate, including revoking the certificate.