Code signing policy
How Dofek's release binaries are signed, who authorises each signature, and what the signature does and does not vouch for.
Last updated 2026-08-01
Status: signing is not active yet. Dofek's binaries are currently unsigned — on Windows SmartScreen may warn, and on macOS Gatekeeper blocks first launch (see the install notes for the workaround). This page describes the signing process as it will operate once the pending SignPath Foundation and Apple Developer enrolments complete. Everything below about roles, provenance, privacy, and what is in scope is already accurate and binding; only the signatures themselves are outstanding. This notice is removed when the first signed release ships.
Signing
Dofek's Windows binaries are code-signed by the SignPath Foundation using a free certificate provided to open source projects, through the SignPath.io signing platform.
The certificate's subject is SignPath Foundation, not "Dofek" or "Asaf Saar". Windows will show that name as the publisher in the SmartScreen and UAC prompts. This is expected — the Foundation is the certificate holder.
macOS binaries are signed with an Apple Developer ID Application certificate and
notarized by Apple. Linux packages are not code-signed; verify them against the
SHA256SUMS.txt published with each release.
Roles
| Role | Held by |
|---|---|
| Committers and reviewers | Asaf Saar |
| Approvers | Asaf Saar |
Every signing request originates from a GitHub Actions run of
release.yml
against a tagged commit in the public repository, and each request is approved
manually by an Approver. Locally built binaries are never signed.
What is signed
| Artifact | Description |
|---|---|
Dofek_<version>_x64_en-US.msi | Desktop installer |
dofek-tui.exe | Standalone terminal UI |
dofek-ollama.exe | First-party plugin — Ollama model status |
dofek-docker.exe | First-party plugin — Docker containers |
dofek-net-ping.exe | First-party plugin — TCP latency sampler |
Third-party plugins are not signed by this certificate. A plugin is an ordinary executable that Dofek runs as a child process with the same privileges as Dofek itself. Install only plugins you trust — a signature on Dofek says nothing about the plugins you add to it.
Privacy
Dofek collects and transmits no telemetry by default. All system metrics — process lists, CPU, GPU, memory, network and disk counters — stay on the local machine and are never sent anywhere.
The only outbound network requests Dofek can make are:
- An opt-in update check against the GitHub releases API, which sends nothing beyond the HTTP request itself.
- An opt-in anonymous usage ping, off unless you enable it, and disclosed on first run.
- An optional read of
http://localhost:8085when you are running LibreHardwareMonitor for CPU temperature and non-NVIDIA GPU data. Local only.
See SECURITY.md for the full threat model and the plugin trust boundary.
Privileged behaviour
Dofek reads the full process list and can terminate a process you select — the same capability Task Manager provides. It is always initiated by you from the UI, never automatically, and Dofek runs with your privileges and never requests elevation.
Reporting a problem
If you believe a signed Dofek binary has been tampered with, or you find a security issue, follow the disclosure process in SECURITY.md. Please do not open a public issue for security reports.