Copperline
Last updated 2 November 2026

Code signing policy

Copperline's Windows downloads are code-signed. Free code signing provided by SignPath.io, certificate by SignPath Foundation. Windows therefore names SignPath Foundation as the publisher of the installer and of the programs it installs.

What is signed

For both x64 and ARM64, each release signs:

  • the installer, Copperline-X.Y.Z-win-x64-setup.exe or Copperline-X.Y.Z-win-arm64-setup.exe;
  • the three programs in the installer and in the portable ZIP: copperline.exe, copperline-ctl.exe and copperline-import-uae.exe.

Only programs built from Copperline's own source are signed. The other files in the downloads, such as Amiga ROM images, WHDLoad support archives and documentation, are not Windows programs and are not signed; those from other projects are shipped unmodified, each with its licence beside it. The uninstaller that Inno Setup writes into the install folder is not signed either.

How a release is signed

Signed files are built by GitHub Actions on GitHub-hosted runners, from the public CopperlineHQ/Copperline repository. The build scripts and SignPath configuration are part of that repository and are reviewed like any other code. SignPath checks that each file it signs came from that build, and signs a release only after an approver has approved it by hand.

Team roles

  • Committers and reviewers: Andrew Hutchings. Contributions from anyone else arrive as pull requests and are reviewed before they are merged.
  • Approvers: Andrew Hutchings.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. The privacy policy lists every feature that can reach the network, each of which you have to ask for.

Checking a signature

Right-click a downloaded file in Explorer, choose Properties, and open the Digital Signatures tab. The signer is SignPath Foundation. In PowerShell, Get-AuthenticodeSignature reports the same.

If you find a file signed with Copperline's certificate that did not come from a Copperline release, or have any other concern about a signed file, please report it on the issue tracker, or privately through GitHub's vulnerability reporting.