Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation. Binaries of stable and beta releases of the Drawpile client for Windows are signed with this certificate since version 2.2.2-beta.4.

Project roles with regards to code signing are as follows:

Owners are the only people who can put code into the main repositories of Drawpile and issue releases. They are:

askmeaboutlo0m, lead developer and maintainer of Drawpile
callaa, original author of Drawpile

Triagers are people who can manage issues and review pull requests, but do not have the ability to merge them or otherwise put code into the main repositories. They are:

There is also many other people who run the community servers, help support artists using Drawpile, test the software, report bugs and contribute code, but they do not have any access to the code that is signed or special permissions in the repositories.

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

The Drawpile client on Windows uses the following shared libraries:

Qt
OpenSSL
KDE Framework Archive

The dependencies are pinned to known good versions and the source code for is verified against the hashes and signatures provided in their releases from upstream. SHA384 hash checks are also done for each build to ensure integrity of the source code retrieved from upstream.

We make some patches to these dependencies when building the application, which you can find in the patches directory of the git repository. Each patch file contains a description as to what it does.

Information about other platforms and links to build processes, versions, upstream source URLs and hashes can be found in the Client Dependencies section of the README.