Code signing policy

Signing lets your computer check that an Agent-Town app really comes from this project and hasn't been changed since it was built.

Windows

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Agent-Town is applying to the SignPath Foundation's program for open-source projects. Until it is approved, Windows releases are not signed, and Windows may show "Windows protected your PC" when the installer is run.

What is signed: the Windows app (agent-town.exe and its add-on library) and its installer (agent-town-setup-<version>.exe), as published on the project's GitHub Releases under tags windows-v<version>.

macOS

The Mac app is signed with an Apple Developer ID and notarized by Apple, so macOS can confirm where it came from before it opens.

How releases are made

• Every release is built from the public source code in the GitHub repository, from a tagged commit on the main branch, with the release scripts in the same repository.
• Only software built from this project's own source is signed. The app includes no proprietary components; it uses the operating system's libraries, the open-source Godot engine on Windows, and Kenney's CC0 models.
• Each signing request is approved by hand by an approver below.
• Every team member must use multi-factor authentication for GitHub and for signing.

Team roles

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it, with one exception that can be turned off: a daily check of GitHub for a newer version (Settings → Updates). See the privacy policy for what the app and the Claude Code plugin send, and where.

Reporting a problem

If you think a signed Agent-Town file has been tampered with, or have any other concern about a release, open an issue on GitHub.