Code signing policy

Last updated: October 27, 2026

Yata releases are not code-signed yet, so Windows SmartScreen may warn the first time you run the installer. This page explains how releases are built and how to check that the file you have is the one published here.

Status

SignPath Foundation, which signs open-source projects for free, declined Yata in October 2026: the program asks for more public visibility than a new project has. Yata will apply again as it grows. Until then, every release is unsigned.

How releases are built

The installer is built by GitHub Actions on GitHub-hosted runners, from a version tag of the public repository (release.yml). Nothing built on a personal computer is published. From v0.2.1 on, each installer also carries a build provenance attestation: a record signed by GitHub that ties the file to the workflow run and commit that built it.

Checking a download

• Checksum: in PowerShell, Get-FileHash .\Yata-Setup-x.y.z.exe must match the line in the release's SHA256SUMS.txt.
• Provenance (v0.2.1 and later): with the GitHub CLI, gh attestation verify Yata-Setup-x.y.z.exe --repo akaneni/yata.
• Build it yourself: the README shows how to build Yata and its installer from source.

A file that doesn't match is not an official Yata build: please open an issue.

Team roles

• Commits, reviews and releases: akaneni, with multi-factor authentication on GitHub. Changes from other contributors are reviewed before they are merged.

Privacy

Yata has no account, server or telemetry. What it sends over the network, and when, is in the privacy policy; the installer shows a summary before installing.