Code signing policy

Applies to the Windows releases of Echo.

What is signed

The Windows binaries of Echo, the echoctl.exe program and its MSI installer, are built from the public source repository github.com/onetest-ai/echo by GitHub Actions, using the workflow .github/workflows/windows-release.yml. They are then signed through SignPath. Signing happens only for builds from that workflow, never for binaries built on someone's own computer.

Every release must be approved by hand before it is signed. Only official Echo releases are signed.

Team roles

Role	Responsibility	Members
Committers	Trusted to change the source code in the repository without further review.	arozumenko, PetroczyP, KarenFlorykian
Reviewers	Review every change proposed by people who are not committers, for example pull requests.	arozumenko, PetroczyP, KarenFlorykian
Approvers	Approve each signing request, and decide whether a release may be signed.	arozumenko, PetroczyP, KarenFlorykian

All team members use multi-factor authentication for both SignPath and GitHub.

Privacy policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. The services Echo can connect to, all set up by the user, are described in the privacy policy.

Installing and uninstalling

On Windows, Echo installs with its MSI installer. To uninstall, open Settings → Apps → Installed apps, find Echo and choose Uninstall. Uninstalling leaves your data folder (transcripts, minutes, notes) in place. Delete that folder yourself if you no longer want it.