Free code signing provided by SignPath.io, certificate by SignPath Foundation.
What gets signed
- The unibox.exe program and the EXE (NSIS) and MSI installers from the official releases on GitHub.
- Every signed file is produced by an automated build (GitHub Actions) from the source code in the public HubGet repository – never on a developer's computer.
- We only sign files built from the project's own code. Third-party tools and libraries are signed by their authors.
- The publisher in the signature is SignPath Foundation, the product name is HubGet.
Who stands behind the signature
| Role | Who | What they may do |
|---|---|---|
| Committers | matous96 (repository owner) | Change the source code without further review. |
| Reviewers | matous96 | Review every contribution from people outside the team (pull requests) before merging. |
| Approvers | matous96 | Manually approve every signing request in SignPath – nothing is signed without approval. |
All team members use multi-factor authentication on GitHub and SignPath.
Privacy
HubGet doesn't send telemetry or information about your computer. When and why it talks to servers (catalog, icons, package managers, optional sign-in) is described in the privacy policy.
How to verify the signature
- Right-click the installer → Properties → Digital Signatures: signed by “SignPath Foundation”.
- In PowerShell:
Get-AuthenticodeSignature .\HubGet_*_x64-setup.exe– statusValid. - Don't run an installer downloaded from anywhere other than the official releases, without a signature or with a different publisher.
Reporting a problem
Report a suspicious signed file or misuse of the signature to the project email and to SignPath Foundation.