Current status
Existing public test files are not yet signed by SignPath Foundation. A file is described as signed only after the trusted GitHub workflow, SignPath checks, and Authenticode verification have all succeeded.
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
This required attribution describes the planned sponsorship after approval and is not a claim that the current release is already signed.
Open source and provenance
LocalDeck uses the Apache-2.0 license. Source code, build scripts, dependency lock, and pinned runtime sources are public on GitHub. Signed releases must be built from an immutable tag on a GitHub-hosted Windows runner.
Full signing policy →Verify a download
First compare the complete SHA-256 with the value on the download page. Once signed releases are available, Get-AuthenticodeSignature must also show status Valid and the expected publisher.
Get-FileHash -Algorithm SHA256 ".\LocalDeck-Setup.exe"
Get-AuthenticodeSignature ".\LocalDeck-Setup.exe" | Format-ListPolicies and reporting
Also review the privacy policy, security model, and public GitHub license. Always report potential vulnerabilities privately.