This page describes how Tomrade’s installers are signed today, the plan for the ones that aren’t yet, and what the program sends over the network.
Where things stand
- macOS: signed with the developer’s Apple Developer ID and notarized by Apple.
- Windows: not code-signed yet. Windows warns you before running the installer; the download page walks you through it.
- Linux: the AppImages are not signed.
The plan for Windows
Tomrade has applied for free code signing from SignPath Foundation, which signs open-source projects at no cost. The application was turned down for now because the project is still new and few people use it yet. We will apply again once more people use Tomrade.
If it is approved, the Windows installer will be signed through SignPath.io with a certificate issued to SignPath Foundation, and its publisher will show as SignPath Foundation. This page will be updated when that happens.
What gets signed
Only installers built from the public source code at github.com/haoyuant/tomrade, licensed under the Apache License 2.0. Tomrade includes no proprietary components, and the code is not sold under any other license.
Every release is built by GitHub Actions from a tagged commit in that repository. Nothing built on a personal computer is published.
Team roles
Tomrade is maintained by one person, Haoyuan Tang (@haoyuant), who holds every role:
- Committers and reviewers: @haoyuant. Contributions from others come in as pull requests and are reviewed before they are merged.
- Approvers: @haoyuant. Each release is approved by hand before it is published, and before it is signed wherever it is.
If the team grows, this page will name the new members and their roles.
Privacy
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it, with one exception: it sends anonymous usage statistics (which features are used and for how long, under a random identifier, never your content) unless you turn them off in Settings. It has no crash reporting.
Everything else it sends goes to services you set up yourself, such as your Tomrade account, a model provider, a coding agent, GitHub or a plugin, and only when you use them. The Privacy Policy lists each of them and what it receives.
Reporting a problem
If you think a Tomrade binary is malicious, or wasn’t built from the public source, write to support@tomrade.com.