Code Signing Policy

Last updated 19 August 2026

Free code signing provided by SignPath.io, certificate by SignPath Foundation

The program is described at signpath.io and signpath.org.

Scope

This policy covers the signed release binaries of mStream — the music streaming server published at github.com/IrosTheBeggar/mStream — and related Iros Software tools when they are signed through the same program. mStream is free software licensed under the GNU GPL v3.

Team and roles

Person GitHub Role
Paul (Iros Software) @IrosTheBeggar Maintainer, reviewer, and release manager. Sole approver of signing requests.

Community contributors submit changes through pull requests, which are reviewed and merged by the maintainer. Contributors do not have access to the signing process or to release credentials.

How releases are built and signed

  1. Releases are built only by the project’s GitHub Actions workflows, from a tagged commit on the master branch of the public repository. No binaries are built or signed on personal machines.
  2. The build produces one self-contained bundle per platform plus a manifest.json listing the SHA-256 of every asset.
  3. Signing requests are submitted to SignPath from that workflow and must be approved by the release manager before a certificate is applied.
  4. Signed artifacts are attached to the GitHub release and are the only binaries linked from mstream.io/server.

Anyone can reproduce a release from the tagged source, and verify a downloaded bundle against the manifest.json checksums.

Privacy

The software does not collect or transmit usage data to the project. The optional network features it does have — Quick Connect, album art and lyrics lookup, the discovery network — are described plainly in the Privacy Policy.

Reporting a problem

If a signed binary behaves unexpectedly, or you believe one has been tampered with, open an issue at github.com/IrosTheBeggar/mStream/issues or report it privately through the repository’s security advisories. Signing for an affected release will be revoked if a compromise is confirmed.