Code signing policy
How DragWheel's Windows releases are built and signed, who is responsible, and what the app sends over the network.
DragWheel has applied to the SignPath Foundation program. Once approved, every Windows release (the installer and DragWheel.exe) is signed this way.
How releases are built
- Every release is built from the public source code at github.com/ilukezippo/DragWheel by GitHub Actions. Nothing is built on a personal computer.
- The tests run on Windows for every change before anything is released.
- Only DragWheel's own files, built from this repository, are signed. Third-party tools that DragWheel downloads on request (for example yt-dlp or cloudflared) keep their own publishers' signatures.
Team roles
- Committers and reviewers: ilukezippo (BoYaqoub). Contributions from others are reviewed before they are merged.
- Approvers: ilukezippo. Every signing request is approved by hand.
All team members use multi-factor authentication for GitHub and SignPath.
Privacy
DragWheel converts files on your own computer and never uploads them for conversions. It collects no usage statistics or personal data. It goes online only for the things listed in the privacy policy: the daily update check (it can be turned off in Settings), one-time downloads you agree to, links you play, and Send to phone when you choose it.
Installing and removing
The installer asks before it changes anything (startup, right-click menu, browser extension are all options you can untick). Settings › Apps in Windows removes DragWheel and everything it added.
Reporting a problem
If you think a signed DragWheel file is harmful or was not built from this project, please open an issue.