romapps.xyz / code signing policy

Code signing policy

How ROM apps are built and released, what is signed today, and how to check that the file you downloaded is the one that was published.

Current status

ROM installers are not code-signed yet. Windows SmartScreen will describe the publisher as unknown. That warning reports a missing signature — it is not a finding about the contents of the file.

A certificate that Windows trusts costs several hundred dollars a year and, since 2023, must be held on dedicated hardware or in a cloud signing service. These apps are free and make no money, so signing is being pursued through routes that do not require that outlay. Until one is in place, every release publishes a checksum so the download can be verified directly.

Verifying a download

Every release includes a SHA256SUMS.txt next to the installer. Run this in PowerShell after downloading; a match means the bytes are identical to what was published.

$f = "$HOME\Downloads\ROM-Trader-Setup.exe"
$want = (irm https://github.com/romanstma-cpu/rom-apps/releases/latest/download/SHA256SUMS.txt).Split(' ')[0]
if ((Get-FileHash $f -Algorithm SHA256).Hash -eq $want) { "MATCH" } else { "DOES NOT MATCH - do not run it" }

The same applies to ROM Convert, using its own repository:

$f = "$HOME\Downloads\ROM-Convert-Setup.exe"
$want = (irm https://github.com/romanstma-cpu/rom-convert/releases/latest/download/SHA256SUMS.txt).Split(' ')[0]
if ((Get-FileHash $f -Algorithm SHA256).Hash -eq $want) { "MATCH" } else { "DOES NOT MATCH - do not run it" }

PowerShell's -eq is case-insensitive for strings, so it does not matter that Get-FileHash prints uppercase while the published sums are lowercase.

How releases are built

Installers are built by GitHub Actions from a tagged commit in the public repository, not from a personal machine. The workflow runs the test suites, packages the installer, computes its checksum and attaches everything to the release. The workflow file is part of the source and can be read alongside it.

App	Source	Releases
ROM Trader	rom-trader	rom-apps
ROM Convert	rom-convert	rom-convert

Both projects are MIT licensed. Releases are cut only by the repository owner, whose GitHub account has two-factor authentication enabled.

What the apps do on your machine

Both install per-user. They never request administrator rights, install no services or drivers, and uninstall cleanly from Add or remove programs.
Both check for their own updates over HTTPS against their GitHub releases, and download nothing else.
ROM Convert reads and writes only the files you give it and the folder you choose for output. It sends nothing anywhere; conversion is done by a bundled copy of FFmpeg running locally.
ROM Trader talks to the Kalshi API and nowhere else. Your API key is encrypted with your Windows account and is never transmitted anywhere except to Kalshi.
Neither app collects analytics, telemetry or personal information.

Third-party components

ROM Convert bundles a static build of FFmpeg, distributed under its own licence (LGPL v2.1+ or GPL v2+ depending on the build) and not covered by this project's MIT grant. It accounts for most of the installer's size. See ffmpeg.org/legal.html.

Both apps are built on Electron, which bundles Chromium and Node.js under their respective licences.

Reporting a problem

If a download does not match its published checksum, or something about a build looks wrong, please open an issue on the relevant repository rather than running the file: ROM Trader · ROM Convert.