Skip to content

Code signing policy

How Irori’s releases are signed

Every Irori download is built from public source by GitHub Actions and signed, so you can check that it comes from this project and hasn’t been changed.

Free code signing provided bySignPath.io, certificate bySignPath Foundation.

What is signed

  • Windows: irori.exe, irori-sign-in.exe and the installer, Irori-X.Y.Z-windows-setup.exe, in every release on thereleases page. They are signed through SignPath Foundation’s program for open-source projects; the project has applied, and Windows builds are unsigned until it is approved.
  • macOS: Irori.app and its disk images are signed with the project’s Apple Developer ID and notarized by Apple.
  • Linux: the apt, dnf and Arch repositories atpackages.irori.app and the packages in them are signed with the Irori packages key.

How a release is built

  1. The source is public at github.com/irori-app/irori. Every change reaches the main branch through a pull request, and mainaccepts it only after the tests pass on Linux, macOS and Windows.
  2. A release starts from a version tag on main. GitHub Actions builds every package from that commit with therelease workflow, installs and starts them on clean systems, then drafts the release with checksums and build attestations.
  3. Only files built by that workflow are signed. Nothing built on a personal computer is sent for signing, and each Windows signing request is approved by hand by an approver.

Who can change and sign Irori

RoleWho
Committers and reviewersMembers of the irori-app GitHub organization: @countradooku
ApproversOwners of the irori-app organization: @countradooku

Privacy

Irori sends no telemetry, analytics or crash reports. When it crashes, the report is saved on your computer and nowhere else.

Without you asking, Irori contacts only these:

  • www.gstatic.com, with an empty request at startup and once a minute, to know whether you are online. Downloads pause while you aren’t.
  • raw.githubusercontent.com at startup, for public lists: anticheat compatibility, known game fixes, and Wine and Proton releases.
  • The stores you have signed in to, at startup and then periodically, to refresh your library and check for game updates. You can turn this off in Settings.

Everything else happens when you use a feature: signing in to a store, installing or updating a game, game artwork and details (ProtonDB, PCGamingWiki, HowLongToBeat, SteamGridDB), store deals, downloading Wine, Proton or an emulator, or uploading a log to dpaste.com when you choose to share it. Each request goes straight to that service, carries only what the feature needs, and is covered by that service’s own privacy policy.

Check a download

  • Windows: right-click the file, choose Properties → Digital Signatures, and check that the signer is SignPath Foundation.
  • macOS: run spctl -a -vv /Applications/Irori.app. It should report Notarized Developer ID from Developer ID Application: RADU MIHAI DIACONU (69QGT49729).
  • Linux: apt, dnf and pacman check every package against the Irori packages key, fingerprint 6DD7 B727 03FE 3BD5 C719 F4CE 6FE6 81AB 798D F656.
  • Any file: compare it with SHA256SUMS in its release, or verify its build attestation with gh attestation verify <file> -R irori-app/irori.

Found a signed file that doesn’t match, or something that looks wrong?Report it on GitHub.