Code Signing Policy
For the MixDB desktop application · Effective 31 August 2026 · Last updated 31 August 2026
Status: not yet in effect. MixDB releases are currently unsigned, and Windows will warn you on first install. This document states the policy that governs signing from the first signed release onward; this paragraph will be replaced with the version number that signing began at.
1. What gets signed
The Windows installer published on the project's releases page, and the executables it contains. Nothing else is signed under this policy — in particular, the macOS and Linux artifacts are covered by their own platforms' mechanisms and are outside its scope.
2. Who may authorise a signed release
MixDB is maintained by one person: mixnz (Nguyễn Hải Quang), who is the project's sole author, reviewer and approver. Only that account may tag a release or approve a signing request. Should anyone else be given that authority, this page is updated before they use it.
The accounts that hold this authority — the GitHub account that can push tags, and the signing service account — have multi-factor authentication enabled.
3. How the binaries are produced
Every released binary is built by GitHub Actions from the public source of this project, from a tagged commit, in a workflow defined in the repository itself: .github/workflows/release.yml. No binary built on a developer's own machine is ever published.
This matters more than the signature does. A signature says the file came from us unaltered; a build you can read the recipe for, run from source, and compare against, says what is in it. Both are published, so both can be checked.
4. Where the signing key lives
The signing key is held in a hardware security module operated by the signing service, and is never downloaded, exported, or present on any machine belonging to the project. Signing happens as a step in the release workflow, which submits the built artifact to the service and receives the signed one back. No person, the maintainer included, can sign a binary by hand outside that workflow.
5. What is not signed with it
MixDB updates itself, and each update carries a second, separate signature made with the project's own updater key. That key is unrelated to the code-signing certificate: it protects the update channel, and is checked by MixDB before an update is installed. Neither signature substitutes for the other.
6. How to verify a download
- Windows — right-click the installer, choose Properties, then the Digital Signatures tab. The signature must be present and valid, and must name this project. If the tab is absent, the file is not one of ours or is an unsigned release predating this policy.
- Source — every release is tagged in the repository, and the workflow that built it is in the tree at that tag. A build you produce yourself from that tag is the same program.
7. Reporting a suspicious binary
If you find a binary presented as MixDB whose signature does not check out, or that was not published on the project's own releases page, please report it to haiquang9994@outlook.com rather than posting it publicly. The same address takes any question about this policy.
8. Licence
MixDB is free software, released under the GNU General Public License v3.0 or later. A single licence covers the whole project; there is no parallel commercial edition and no dual licensing.
9. Changes to this policy
A revised policy appears on this page with a new effective date. Changes to who may authorise a release, or to where the key is held, are announced in the release notes of the version that introduces them.
mixnz — Nguyễn Hải QuangCẩm Mỹ, Đồng Nai, Vietnam
haiquang9994@outlook.com