Effective 11 October 2026

Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Signing starts with the first release after SignPath Foundation accepts the project. Until then the Windows builds are unsigned, and Windows warns about an unknown publisher the first time you run one.

What gets signed

The Windows builds: the installer (Grimoire-Setup-<version>.exe), the portable Grimoire-Portable-<version>.exe, and the Grimoire.exe inside them. GitHub Actions builds them from a tagged commit in Slush97/grimoire, then hands them to SignPath. Nothing built on someone's own machine gets signed.

The installer also carries vpkmerge.exe, the open source tool Grimoire uses to read and write game files. GitHub Actions builds it from Slush97/vpkmerge.

Linux and macOS builds aren't covered here. Every release ships a SHA256SUMS file and build provenance attestations for all platforms, and the download page shows how to check them.

Who can sign

Grimoire has one maintainer, who holds every role.

• Committers and reviewers: Slush97. Changes from anyone else get reviewed before they're merged.
• Approvers: Slush97. Every release is approved by hand before SignPath signs it.

Privacy

Grimoire has no telemetry. Every request the app can make, who receives it, and how to turn it off is on what leaves your machine, along with links to the privacy policies of the services it talks to. This website has its own privacy policy.

Checking a signature

Right-click the .exe, open Properties, then the Digital Signatures tab. A signed Grimoire build lists SignPath Foundation as the signer.

Something looks wrong?

If a signed file doesn't match a release, or you think this policy was broken, open an issue on GitHub or say so in the Discord.