Code Signing Policy

What this page is for

Code signing puts a verifiable publisher name on a Windows executable. It is what turns “Unknown publisher” in a User Account Control prompt into “TechyGeeksHome”, and it is what stops SmartScreen warning every person who downloads one of our tools.

A signature is only worth anything if the process behind it is disciplined. This page sets out that process publicly, so anyone. A user, a moderator at a download site, or a certificate authority. Can see exactly who is able to sign a TechyGeeksHome binary and under what conditions.

Who we are

TechyGeeksHome is a small independent publisher of free Windows software, based in the United Kingdom, publishing at techygeekshome.info and github.com/techygeekshome.

Roles

There is one maintainer. The same person is the repository owner, the release approver and the signing approver. There is no wider team, no contractors and no third party with access.

• Repository owner – owns every repository under the techygeekshome GitHub organisation, and is the only account with write access to a default branch.
• Release approver – the only person who can create a version tag, which is the only thing that triggers a release build.
• Signing approver – the only person authorised to approve a signing request. Signing is never automatic and never unattended.

How a release is built

Every published binary is built by GitHub Actions from the public source in that project’s repository. Nothing is built on a personal machine and uploaded by hand.

1. A change is committed to the repository and passes the build workflow, which compiles the project and runs its tests.
2. The maintainer pushes a version tag, for example v1.1.0.
3. The release workflow builds the application, compiles the installer, and computes a SHA-256 hash of every artefact.
4. The workflow refuses to publish if the compiled binary does not report the version in the tag. A mislabelled release is treated as a failure, not a warning.
5. The artefacts and a SHA256SUMS.txt file are attached to the GitHub release.

The workflow file is in each repository under .github/workflows/release.yml and is public. Anyone can read exactly what produced a given download.

How signing is authorised

• Signing happens inside the release pipeline, against an artefact the pipeline has just built from a tagged commit in the project’s own repository.
• Every signing request requires explicit approval by the signing approver. There is no policy that signs automatically on a push, a schedule or a pull request.
• Only artefacts built from TechyGeeksHome’s own source are ever submitted for signature. We do not sign anyone else’s binaries, repackaged third-party software, or anything built outside the pipeline.
• The signing key is held by the signing service. It is never exported, never stored in a repository, and never present on a personal machine.
• If a signing request appears that the maintainer did not initiate, it is denied and the credentials are rotated.

Account security

• Multi-factor authentication is enabled on the GitHub account that owns the repositories, and on the signing service account.
• No shared logins. No service accounts with standing write access.
• Release credentials are held as encrypted repository secrets and are only readable by the release workflow.

Privacy

Our applications do not collect anything about you or how you use them. There is no account to create and nothing is uploaded from your machine.

The only network request any of our desktop applications makes is an update check, and only when you press the button that performs it. That request asks GitHub for the latest published version number of that application. Nothing about you or your machine is sent with it.

Where an application needs the network to do the job you asked of it -DriverGeek retrieving a driver from Windows Update, AppGeek installing a package through winget – that is the documented purpose of the feature and it happens only when you start it.

What our software will not do

• Nothing installs, updates or removes anything without an explicit tick and a confirmation. Nothing runs on a schedule unless you set that schedule up yourself.
• Every installer has a matching uninstaller, and every application appears in Windows’ own Apps & features list.
• Changes to system configuration are stated in plain words before they happen. Where an action is not reversible, we say so.
• No bundled offers, no third-party installers, no adware, no toolbars.
• Nothing in our range is a hacking tool. None of it exists to identify or exploit security vulnerabilities, or to circumvent a security control or licence check.

Verifying a download yourself

Every release publishes a SHA256SUMS.txt alongside the downloads. To check a file you have downloaded, run this in PowerShell and compare the result to the published hash:

Get-FileHash .\TheFileYouDownloaded.exe -Algorithm SHA256

Do this whether or not a build is signed. A hash you check yourself is stronger evidence than a signature you have not looked at.

Reporting a problem

If you believe a signed TechyGeeksHome binary has been tampered with, or you have found a security issue in any of our software, raise an issue on that project’s GitHub repository or use the contact form on this site. Security reports are dealt with before feature work.

This page is maintained as our public code signing policy. It was last reviewed on 30 August 2026.