Code signing policy
Varyz is open source, and its source is public in egrm07/varyz. Every release lists the SHA-256 checksums of its files on GitHub Releases, so you can check that the file you downloaded is the one that was published.
Windows
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
Status: Varyz is applying to the SignPath Foundation program for open source projects. Signed Windows installers will be built by GitHub Actions from the public source and signed only after a person approves each release. Until a release is signed, the Windows installer is unsigned and Windows may show a warning before it runs. Each signed release will say so in its release notes, and Windows will then name SignPath Foundation as the publisher.
Only the Windows installer built from Varyz's own source is signed. It includes Python and other open source packages that their own maintainers publish; Varyz does not sign their files under its own name.
macOS
The Apple Silicon and Intel installers are signed with an Apple Developer ID, notarized by Apple and stapled, so macOS checks them before they open.
Team roles
- Authors, who may change the source without another review: Egor Menshikov (egrm07).
- Reviewers, who review every change from anyone else, such as a pull request: Egor Menshikov.
- Approvers, who approve each signing request by hand: Egor Menshikov.
Privacy
Varyz runs on your computer and needs no account. It sends nothing to other computers unless you turn a feature on, with one exception: it checks varyzai.com once an hour for news posts, and the request carries nothing about you (turn it off with varyz news off). The privacy policy lists every connection Varyz makes and every choice you have.
Report a problem
If you think a signed Varyz file is not what it should be, write to support@varyzai.com. We will check the build that produced it and publish what we find.
Start with what you already know.
Your preferences, your project history and your standards, ready for the next task.