Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Obeya has applied to the SignPath Foundation. Until the application is accepted, the Windows installer is not signed. The Mac apps are signed with the maintainer's Apple Developer ID and notarised by Apple. The Linux packages are not signed. Every release lists the SHA-256 of each of its files in SHA256SUMS.

What is signed

The Windows installer (Obeya-Windows-x64-setup.exe) and the programs Obeya builds into it. They are built from a version tag of github.com/sadilek/obeya by the repository's GitHub Actions workflow (.github/workflows/build.yml). Nothing built anywhere else is signed, and neither is the software of other projects.

Team roles

• Committers and reviewers: Daniel Sadilek (owner of the repository)
• Approvers: Daniel Sadilek

Most changes are written by coding agents that the maintainer directs with Obeya. Each one reaches main only after the maintainer has approved it. Pull requests from others are reviewed by a committer before they are merged. Each release is signed only after an approver has approved its signing request. Everyone on the team uses multi-factor authentication for GitHub and SignPath.

Privacy

Obeya runs on your computer. It sends nothing to its makers and collects no usage data. It connects to other systems only in these cases:

• Agents: Obeya's agents run on the Claude Code installed on your machine, under your own account. Claude Code sends what the agents work on to Anthropic (Anthropic's privacy policy).
• Updates: the app asks GitHub for the latest release when it starts and every six hours (GitHub's privacy statement). It installs an update only when you click.
• When you ask for it: tools that the setup installs at your click (from their publishers), speech models for voice input and demo narration (from Hugging Face), push notifications on your phone (through your phone browser's push service), pull requests (through GitHub's gh), and narration by a text-to-speech service whose key you enter. Your phone reaches Obeya over your own private network (Tailscale or another VPN), not through a service of Obeya's.