Code Signing Policy
How MinbarLive releases are built, who authorises them, and what the published Windows executable is.
What you will see on each platform:
| Windows |
Microsoft Defender SmartScreen warns ("unrecognized app", "Unknown
publisher") the first time MinbarLive.exe runs. Choose
More info → Run anyway.
|
|---|---|
| macOS |
The build is unsigned and un-notarized, so Gatekeeper refuses it on
first launch. Open it once via right-click → Open, or clear
the quarantine attribute with
xattr -dr com.apple.quarantine /Applications/MinbarLive.app.
Apple Silicon (arm64) only — there is no Intel build.
|
| Linux |
The AppImage is unsigned; Linux shows no publisher prompt. Mark it
executable (chmod +x) and verify it against
SHA256SUMS-linux.txt.
|
Project identity
| Project | MinbarLive |
|---|---|
| Homepage | minbarlive.info |
| Source | github.com/MinbarLive/MinbarLive |
| License | AGPL-3.0 |
| Releases | github.com/MinbarLive/MinbarLive/releases |
| Published artifacts | MinbarLive.exe (Windows), MinbarLive-x86_64.AppImage (Linux), MinbarLive-macos-arm64.zip (macOS, Apple Silicon) — all built with PyInstaller. None is signed. |
MinbarLive is an open-source tool that displays real-time translated subtitles for mosque lectures. It contains no proprietary components beyond the operating system libraries it links against.
Team and roles
MinbarLive is currently maintained by a single person. All three roles are held by the same GitHub account, and this section is updated if that changes.
| Role | Held by | Responsibility |
|---|---|---|
| Author | @mosait | Writes and commits code; may push to main. |
| Reviewer | @mosait | Reviews and approves every contribution from outside the project before it is merged. |
| Approver | @mosait | Authorises each individual signing request. Signing is never automatic and never unattended. |
All accounts with write access to the repository and to the signing platform have multi-factor authentication enabled.
How a release is built
Release binaries are never built or uploaded from a personal machine. They
are produced by a GitHub Actions workflow
(.github/workflows/release.yml)
from the public source at a tagged commit:
- The workflow triggers on a
v*tag and runs on clean GitHub-hosted runners — one each for Windows, Linux and macOS. - Dependencies are installed from
requirements.txt, which pins exact versions. - The test suite runs before the build.
- The tag is checked against the version compiled into the application; a mismatch fails the build.
- PyInstaller builds each binary from
MinbarLive.spec. - Every binary is launched on its own runner and the build fails if it does not start.
- A SHA-256 checksum is published for each:
SHA256SUMS.txt,SHA256SUMS-linux.txtandSHA256SUMS-macos.txt.
Anyone can re-run the same workflow from the same tag and inspect every step in the public Actions log.
Privacy
MinbarLive runs locally on the operator's machine. It has no backend, no account system, and no analytics or telemetry.
To produce subtitles it sends audio, transcripts and recent session context to the AI service the operator configures, using the operator's own API key; API keys live in the operating system's credential store, and transcripts and logs stay in a folder on the operator's machine. It carries no analytics, telemetry or crash reporting, does not modify system configuration, installs no background services and bundles no third-party offers.
The full disclosure, including every outbound connection the software makes, is in the privacy policy.
Reporting a problem
Only executables downloaded from the official releases page or from the download button on minbarlive.info are published by this project. Verify a download against the published SHA-256 checksum if in doubt.
If you believe a signed MinbarLive binary has been tampered with, or you find a security issue, please open an issue at github.com/MinbarLive/MinbarLive/issues.