rhun. Get rhun

Code signing policy

How rhun’s Windows executables are signed, who approves it, and what rhun sends over the network.

Windows releases

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

The signed files are rhun.exe and rhun.com in the Windows ZIP of each release. The release workflow builds them from the release’s tag in vshvedov/rhun on GitHub-hosted runners, tests them, and submits them for signing. A person approves every signing request. rhun’s signature covers nothing else: extensions, their language servers, and the programs rhun starts are signed by their own authors, if at all.

Signing starts with the first release after SignPath Foundation accepts rhun; earlier Windows releases are unsigned. Every release’s ZIP SHA-256 is in its SHA256SUMS, and the installer and updater check it.

Team roles

  • Committers and reviewers: Vlad Shvedov. Changes from anyone else arrive as pull requests and are reviewed before they are merged.
  • Approvers: Vlad Shvedov.

Privacy

rhun has no telemetry and no accounts. On its own it contacts only GitHub:

  • Release builds check github.com for a new rhun version a few seconds after starting and once a day. Turn this off with Check for updates in Settings (check = false under [updates]).
  • When you have extensions installed, rhun checks GitHub for their updates a minute after starting and once a day. [updates] extensions decides what happens to them.

Everything else that uses the network happens only when you ask for it: installing an extension, a remote window, Git commands, and commit-message drafts, which send the diff to the provider you chose. Each one is described in the guides. Programs you run in rhun’s terminal, and extensions within the permissions they declare, use the network on their own terms.