Skip to content

code-signing-policy.md

Latest commit

 

History

History
121 lines (97 loc) · 7.47 KB

code-signing-policy.md

File metadata and controls

121 lines (97 loc) · 7.47 KB
Raw

Code signing policy

This page says how Botloft's releases are made, who may release them, what Botloft sends over the network and what it changes on your computer.

Status

Botloft's releases are not code-signed yet. Until they are, Windows SmartScreen may ask you to confirm when you run the installer, and an antivirus may flag it by guesswork (a "machine-learning" or "heuristic" detection), as happens with new programs that have no signature. If that happens to you, please open an issue; we report every false positive to the vendor.

The release pipeline is ready to sign Botloft.exe, botloftd.exe, the setup window, the installer and the uninstaller as soon as a certificate is in place. All of them carry the product name "Botloft" and the version of the release.

Botloft does not have a code signing certificate yet. When it gets one, this page will say whose name is on it, and every release from then on will be signed with it.

On macOS, Botloft is not notarized by Apple: there is no Apple Developer account for it yet. The app carries an ad-hoc signature only, so macOS blocks its first opening until you allow it in System Settings > Privacy & Security > Open Anyway. The Linux packages (.deb and AppImage) are not signed either. On every system, updates are signed with Botloft's own updater key (below).

How releases are made

  • Every release is built by GitHub Actions (release.yml) from a vX.Y.Z tag on main, on GitHub's own runners. Nothing is built on a maintainer's computer.

  • The workflow opens a draft release. A person reads it and publishes it: no release goes out without that manual approval.

  • Each download (the Windows installers, the Linux packages and the macOS disk image and update) gets a build provenance attestation, and the release notes list its SHA-256. To check that a download came from this repository's workflow, with the GitHub CLI:

    gh attestation verify Botloft_<version>_x64-setup.exe --repo httpsphl/botloft

    This applies to releases after 0.6.0.

  • Updates are signed with Botloft's own updater key. The app checks the signature, and that it was made for the version announced, before it installs anything.

Team roles

Privacy

Botloft has no telemetry and no analytics, and it works without any account. The background service listens on 127.0.0.1 only. What goes over the network:

  • Update check. When the app opens, and every 6 hours while it is open, it asks GitHub for the latest release's latest.json. It downloads an update only when you click Update now. No information about you or your bots is sent.
  • Your bots. Each bot is Claude Code running on your computer with your own Claude account. What it sends to Anthropic, and the websites it opens when its work needs them, are the same as when you use Claude Code yourself. So is what it sends to a tool you connect and turn on for it (Settings > Connected tools); a tool at an address is outside your computer.
  • The optional cloud account. Only if you sign in, and only when you send a copy or turn on automatic copies (every day or week, and only when something changed). The server gets your e-mail address, the name of your computer, and the light backup you choose to upload: it is sealed on your computer with the backup password, which never leaves it, so the server cannot read it. For automatic copies Windows keeps that password in its credential store, readable only by your user account. Signing out, deleting a copy or deleting the account is in the app. The server is the botloft-cloud crate in this repository, and the address is a setting, so you can run your own.
  • A connected phone. Only if you connect one (Settings > Account and phone), which needs the account. While a phone is connected, or you are connecting one, the background service keeps one outgoing connection to the server, which carries what the phone and the computer say to each other: requests, questions, answers and the bots' chats. It is sealed end to end with keys only the two of them have, so the server sees when and how much passes, never what. The server keeps the phone's name and, if you turn on notices on the phone, the address its browser gave for them. Each notice is empty and goes through that browser's push service, which learns only that a notice arrived. Disconnecting the phone, from the computer or from the phone itself, cuts it off at once, and signing out of the account disconnects every phone.

What Botloft changes on your computer

  • It installs for your Windows user only, under %LOCALAPPDATA%\Botloft, with shortcuts in the Start menu and on the desktop. It never asks for an administrator.
  • It registers a scheduled task for your user, named "Botloft", that keeps the bots running: it starts when you sign in and brings the background service back if it stops. Settings > General turns off starting with Windows, or stops the bots when you close the app.
  • While the bots start with Windows and Botloft stays near the clock or opens its window at sign-in, the app adds itself to your user's startup programs. Settings > General turns each of these off.
  • While a bot is working, it asks Windows not to put the computer to sleep. Settings > General turns this off.
  • Bots keep their work in %USERPROFILE%\Botloft, or in the folder you pick for a crew.

On Linux and macOS (preview since 0.8.0):

  • Linux: the .deb installs the app in /usr/bin (installing it asks for your password, as any package does); the AppImage stays wherever you put it. Botloft's data is in ~/.local/share/Botloft. A systemd user service, botloft.service in ~/.config/systemd/user, keeps the bots running; it starts when you sign in if Botloft starts with the system. When Botloft opens its window at sign-in, it adds ~/.config/autostart/botloft.desktop.
  • macOS: the app goes wherever you drag it, usually Applications. Botloft's data is in ~/Library/Application Support/Botloft. A launch agent, ~/Library/LaunchAgents/io.github.httpsphl.botloft.daemon.plist, keeps the bots running; when Botloft opens its window at sign-in, it adds io.github.httpsphl.botloft.app.plist next to it.
  • Bots keep their work in ~/Botloft, or in the folder you pick for a crew.
  • While a bot is working, a helper keeps the computer from sleeping when idle: caffeinate on macOS, systemd-inhibit on Linux. Settings > General turns this off.

Uninstalling

Settings > Apps > Installed apps > Botloft > Uninstall removes the app, stops the background service, and removes its scheduled task and the startup entry. Your bots, their conversations and their files stay in %LOCALAPPDATA%\Botloft and %USERPROFILE%\Botloft; delete those two folders to remove everything.

On Linux and macOS, removing the app does not stop the background service, so stop it first:

~/.local/share/Botloft/bin/botloftd service uninstall                    # Linux
~/"Library/Application Support/Botloft/bin/botloftd" service uninstall   # macOS

Then remove the app (sudo apt remove botloft, the AppImage file, or the app in Applications) and, on macOS, ~/Library/LaunchAgents/io.github.httpsphl.botloft.app.plist if it is there. Your bots and data stay in the data folder above and in ~/Botloft; delete those to remove everything.