Attribution
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
1. What is signed
Windows release binaries published by the Doriax Engine project carry an Authenticode signature. This covers the editor executable, its command-line companion, and the engine runtime library that ships beside them. Signing was introduced in August 2026; builds published before then are unsigned.
macOS and Linux builds are not signed at this time. Builds you compile yourself from source are unsigned, which is expected and not a sign of tampering.
2. How binaries are signed
Binaries are built by GitHub Actions from the public doriaxengine/doriax repository. The workflow that produces them is part of that repository and is reviewed like any other source change.
Signing happens after the build, on SignPath's infrastructure. The private key is held by SignPath and is never present on a build machine, on a maintainer's computer, or in the repository. SignPath records the repository, branch, and commit behind every signature, so each signed binary can be traced back to the source it was built from.
Released binaries are signed under a certificate held by SignPath Foundation, which provides code signing free of charge to open-source projects. Because the certificate is issued to the Foundation rather than to this project, Windows shows SignPath Foundation as the publisher of Doriax Engine binaries. That is expected and correct. Development builds may instead carry a test signature, which is not trusted by Windows and is not intended for distribution.
3. Who can request and approve a signature
The Doriax Engine project is maintained by Eduardo Doria, who is the sole committer with write access to the repository and the sole approver of signing requests. Contributions from other people arrive as pull requests and are reviewed before they can become part of a signed build.
Signing requests can only be submitted by the project's continuous integration workflow, and only for builds of this repository. Repository and SignPath access are protected with multi-factor authentication.
4. Verifying a download
On Windows, right-click the downloaded .exe, choose Properties, and open the Digital Signatures tab. A genuine release shows a valid signature from SignPath Foundation, for the reason explained above. If that tab is missing, or the signature does not validate, do not run the file.
Antivirus products occasionally flag newly published, low-circulation binaries even when they are correctly signed. If that happens, please open an issue so it can be reported to the vendor.
5. Privacy and contact
Information handling for the Doriax website and software is described in the Privacy Policy.
To report a suspicious binary claiming to be Doriax, or any concern about a signature, email studio@doriax.org.