Code signing policy
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
Riftgate has applied to the SignPath Foundation's free signing program for open-source projects. Until it's accepted, Windows installers are not signed yet; from then on, every Windows installer is signed as described here.
What is signed
The Windows installer (Riftgate-Setup-<version>.exe) of every release on GitHub Releases. Its product name is Riftgate and its version is the release's version. Riftgate signs only what its own team builds from its own source code.
How it's built
Every release is built from the public source code on GitHub's own Windows machines, by the Publish Windows Release workflow. Nothing is built or signed on a personal computer. SignPath checks that the installer came from that workflow and that repository before signing it, and each signing request has to be approved by hand.
Team roles
Authors (may change the source code without a further review), reviewers (review every change from anyone else, such as pull requests) and approvers (approve each signing request): Raidex81, the project's owner and maintainer. Everyone in these roles uses multi-factor authentication on GitHub and SignPath. Contributions from others come in as pull requests and are reviewed before they're merged.
Privacy
Riftgate doesn't send anything about you without you asking for it: the only thing it can send on its own is an anonymous weekly count, and only after you say yes in the app. Everything it does ask the internet for, and why, is on the privacy page.
Checking a signature
Right-click the installer → Properties → Digital Signatures: the signer is SignPath Foundation. Or in PowerShell: Get-AuthenticodeSignature .\Riftgate-Setup-<version>.exe should say Valid.
Something looks wrong?
If a file claims to be Riftgate but isn't signed by SignPath Foundation, or came from anywhere other than GitHub Releases, don't run it. Tell us at riftgateappdev@zohomail.eu with where it came from and its SHA-256, or see SECURITY.md.