Legal

Code Signing Policy

for the Windows installers of TwoGG Pinecone · Last updated: 14 October 2026

1. What is signed

The Windows installers (…_x64-setup.exe and …_x64_*.msi) published on the GitHub releases page. They are built by GitHub Actions directly from the tagged source code in the public repository wheatley2056/twogg-pinecone (workflow .github/workflows/release.yml). Nothing is built or signed on a personal computer.

Only software from this repository is signed. Third-party programs are never signed with this certificate.

2. Team roles

• Committers and reviewers: members of the repository. Changes from outside contributors are merged only after review through a pull request.
• Approvers: Tobias Kern (wheatley2056). Every signing request for a release is approved manually.

All team members use multi-factor authentication for GitHub and SignPath.

3. Privacy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. Pinecone connects to services only for what you use: Microsoft and Mojang for signing in and downloading Minecraft, Modrinth and the Pinecone server for mods, modpacks, news and the friends list, twogg.app for the event calendar and, if you link your TwoGG account, your sign-ups, and GitHub to check for new versions. There is no tracking or analytics. Details are in the privacy policy.

4. Reporting

If you find a signed file that does not come from this project, or have any other concern about signing, write to legal@twogg.de.