Code Signing Policy
===================

DCOR-Aid uses free code signing provided by `SignPath.io <https://about.signpath.io/>`_,
certificate by `SignPath Foundation <https://signpath.org/>`_. These binaries
can be downloaded from the `release page <https://github.com/DCOR-dev/DCOR-Aid/releases>`_.


Project Integrity
-----------------

To verify the integrity of DCOR-Aid, we manage access to the DCOR-Aid repository
via GitHub Team roles:

- **Triage**: The `Members team of DCOR-dev <https://github.com/DCOR-dev/DCOR-Aid/teams/members>`_
  has permission to triage (e.g. modify issues).
- **Core**: The `Core team of DCOR-dev <https://github.com/DCOR-dev/DCOR-Aid/teams/core>`_
  consists of people who are trusted to modify the source code in the project's
  version control system without additional reviews.
- There is no special role for *Commiters*. External contributors or members
  of the *Triage* team must create a pull request which is reviewed by a
  *Core* team member.
- Furthermore, we enforce 2FA for every member of the DCOR-dev GitHub
  organization.


Privacy Policy
--------------
You can find the privacy policy for the default DCOR instance hosted by the
Max Planck Gesellschaft at https://dcor.mpl.mpg.de/privacy.
If you are connecting to a different DCOR instance, please contact the
corresponding provider.