Skip to content
Melange
You are reading the docs for Melange 0.9.0. Read the latest.

Code signing

Melange releases from 0.3.1 on are code-signed. You can check the signature in the file’s Properties > Digital Signatures tab, or with Get-AuthenticodeSignature <file> in PowerShell.

  • What is signed: melange.asi, Melange.exe and tools\xomtool.exe in the release zip. dinput8.dll is the unmodified Ultimate ASI Loader and is not signed by Melange.
  • How: the release workflow builds the binaries from this repository’s public source on a GitHub-hosted runner when a version tag is pushed, signs them with Azure Artifact Signing (SHA-256, timestamped), checks the signatures, and attaches the zip, its SHA-256, and its update manifest melange-<version>.json (the zip’s name, size and SHA-256) to the GitHub release. No locally built binary is ever signed.
  • By whom: the certificate is issued to the maintainer, JaminB, who is the only committer, reviewer and approver of releases.
  • Where: https://github.com/JaminB/melange/releases is the only source of signed Melange releases. Forks and mirrors cannot produce them.
  • Updates: Melange.exe installs a new release only when the zip matches the size and SHA-256 in the release’s manifest, and the new Melange.exe and melange.asi carry a valid signature from the same publisher as the running Melange.exe. “Same publisher” means the certificate’s subject and its issuing organisation match; the short-lived certificates themselves change every few days. A developer build is unsigned, so it skips that comparison and says so in its log.
  • Privacy: signing transfers no user data. Melange collects no telemetry. It contacts GitHub when you open the Store, when Melange.exe starts (to look for and download a newer Melange), and from the game at most once a day ([Update] CheckInGame=1). Settings › Updates › Check for updates automatically in Melange.exe turns off both automatic checks. Each request is a plain HTTPS GET that sends nothing about you or your game.