CODE SIGNING

Code signing policy

The rules a Shotoshot release must follow to be signed: where it is built, who approves it, and how to report a problem.

Status: Shotoshot is applying to SignPath Foundation’s code signing program for open-source projects; until it is accepted, the downloads are not signed yet.

Signing service

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

This page is the policy that SignPath Foundation’s terms ask every project to publish.

Team roles

Authors and committers: Mickaël Mancini (Chmyke on GitHub), the sole author. No other account has write access to the public repository.

Reviewers: Mickaël Mancini (Chmyke).

Approvers: Mickaël Mancini (Chmyke), who approves each signing request.

One person holds every role because Shotoshot has a single maintainer and code contributions from outside are not merged. Bug reports and ideas are welcome as issues; see CONTRIBUTING.md.

From source to signature

The source code is public at github.com/Chmyke/shotoshot, under the GPL-3.0-only license.

The binaries of a signed release are built automatically from that public repository by GitHub Actions, with the workflow .github/workflows/build.yml.

Every release is approved manually before signing.

Privacy policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Shotoshot has no account and no telemetry, and makes no network request of its own. Its only upload is the Search with Google Lens button: when you click it, the selected area and its annotations are sent to Google and the results open in your browser. Nothing is sent before that click.

What this website measures is described on the privacy page.

Reporting a violation

If you think a signed Shotoshot release does not follow this policy, open an issue on GitHub. For a security problem, report it privately as SECURITY.md describes: the Security tab of the repository, then “Report a vulnerability”.

You can also write to SignPath directly, at support@signpath.io.

Last updated: October 10, 2026.