Security

Code Signing Policy

Last updated: July 22, 2026

The short version: Chip Hippo is in pre-release, and its installers are not yet code-signed. macOS and Windows will warn you before running an unsigned app — that's expected. Every build is produced in the open by GitHub Actions straight from the public source, so you can verify it yourself or build from source. Signing is wired into the release pipeline and switches on once certificates are configured.

Chip Hippo is a free, open-source (Apache-2.0) desktop app for designing and simulating 74xx TTL logic circuits, built and maintained by Jason Figge. This page documents how its release binaries are produced and signed, and how you can verify a download you received is genuine.

1. Current status — unsigned pre-release

While the app is pre-1.0, published installers are shipped unsigned. That means:

macOS Gatekeeper will say the app “cannot be opened because the developer cannot be verified.” Right-click (or Control-click) the app and choose Open, then confirm — you only need to do this the first time.
Windows SmartScreen will show a blue “Windows protected your PC” prompt. Click More info → Run anyway to launch it.
Linux packages are not code-signed (Linux uses distribution-level trust); make an AppImage executable with chmod +x, or install the .deb with your package manager.

2. How builds are produced

Installers are never built on a personal machine. Every release is built by a GitHub Actions workflow running on GitHub-hosted runners, from a tagged commit in the public source repository — macOS on a macOS runner, Windows on a Windows runner, Linux on a Linux runner. The build configuration (the Makefile and .github/workflows) is part of that public repository and is fully auditable.

3. When signing turns on

The release pipeline already contains the signing steps; they are gated on credentials being present, so they activate without any code change once the certificates are configured:

macOS — builds will be signed with an Apple Developer ID certificate and notarized by Apple, so Gatekeeper opens them without a warning.
Windows — installers will be Authenticode-signed and timestamped. When signing is provided through a foundation program for open-source projects, the verified publisher Windows shows may be that foundation rather than “Jason Figge” — that is normal and is itself a trust signal that the build came through the reviewed release pipeline.

This page will be updated with the exact signing details (and the expected publisher name) when signing is enabled.

4. Where to get genuine builds

Only download Chip Hippo from official sources: the chiphippo.com downloads section (which links to GitHub) and the project's GitHub Releases. Binaries obtained anywhere else are not covered by this policy and should not be trusted.

5. Verifying a download

Because the current builds are unsigned, verify integrity against the checksums published with each release. Every GitHub Release includes electron-updater metadata (latest.yml / latest-mac.yml / latest-linux.yml) containing the SHA-512 hash and size of each installer. Compute the hash of your download and confirm it matches:

macOS / Linux: shasum -a 512 <file> (then base64-encode to compare, or compare the raw hash).
Windows: certutil -hashfile <file> SHA512.

When in doubt, you can always build from source with make dist-mac / dist-linux / dist-win.

6. Reporting a problem

If you find a binary that claims to be Chip Hippo but is signed by an unexpected publisher, fails checksum verification, or is otherwise suspicious, open an issue on GitHub. Because the project is open source, the entire build and signing configuration is public and auditable in the repository.