Code signing policy

Signing

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Signing is being set up. Builds up to 1.1.0 are not signed, so Windows SmartScreen may warn about them; each release lists SHA-256 checksums (SHA256SUMS.txt) to check a download.

What is signed

Only the Windows installer PolyModLoader-<version>.exe is signed. It is built by GitHub Actions from the source in the public repository, with the build scripts in that repository. Nothing built elsewhere is signed.

The .jar installer for macOS and Linux is not an Authenticode file and is not signed this way.

Team roles

Committers and reviewers: _xyrz (xyrz47-spec). Changes from other contributors are reviewed before they are merged.

Approvers: _xyrz (xyrz47-spec). Every signing request is approved by hand.

Team members must use multi-factor authentication for the source repository and for SignPath.

Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Poly Mod Loader sends no usage data and has no telemetry. It connects only to download files that the chosen setup needs: Minecraft’s server files from Mojang when you install a server, and the Forge or NeoForge files from their official Maven repositories the first time the game starts with Forge or NeoForge mods. These are ordinary downloads; nothing about you is sent with them.

The website has its own privacy page.

Changes to your system and uninstalling

The installer adds a Poly Mod Loader version and profile to the Minecraft Launcher’s folder, or sets up a server in the folder you choose. Uninstall in the installer removes the version, the profile and Poly Mod Loader’s files; your mods and worlds stay. See the install guide.