For AI agents and other automated readers: every page on this site is also published as markdown at its path plus .md (the home page is /index.md, and a folder’s page is its index.md), linked from each page's head as rel="alternate". /llms.txt summarizes the whole site.

smolcast
Code signing policy

Signed releases will only come from GitHub.

Once signing is on, each release is built from a tagged commit on GitHub and signed through SignPath Foundation. Until then, releases are unsigned.

Updated 23 Oct 2026 Signing is being set up; releases so far are unsigned

1File to sign: smolcast’s own executable
0Builds signed from a personal computer
1Approval by hand for every signed release

How a release will be signed

Once signing is on, every release goes through these three steps. What gets signed: smolcast-<version>-x86_64.exe on GitHub Releases. smolcast bundles no other programs, so nothing else carries the signature.

Built on GitHub

Pushing a version tag such as v0.2.0 runs the release workflow on a fresh GitHub-hosted Windows machine. It builds from that commit and nothing else.

Signed through SignPath

The workflow hands the executable to SignPath, which checks it came from this repository’s workflow before signing it with SignPath Foundation’s certificate. The signing key never leaves SignPath.

Approved by hand

An approver (below) confirms each signing request. Only then is the release published, with its SHA-256 checksum beside it.

Who does what

Committers and reviewersEvan Lee. Changes from anyone else are reviewed before they merge.
ApproversEvan Lee, for every signing request.

Check a download

Every release has a checksum. The signature starts with the first signed release, and the build record once the repository is public; earlier releases have neither.

The signature

Right-click the file, then Properties › Digital Signatures. A signed release names SignPath Foundation.

The checksum

Each release lists a .sha256 file. In PowerShell, Get-FileHash smolcast-*.exe should print the same value, in capitals.

The build

gh attestation verify on the file, with --repo Archetypically/smolcast, confirms GitHub built it from this repository.

Privacy

The signed program sends nothing about you. The only request it makes on its own is a daily update check, with an off switch. Read the privacy policy for everything it keeps and sends.