← Roar

Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What gets signed

Roar's Windows releases (Roar.exe and roar-mcp.exe, x64 and ARM64). They are built only by GitHub Actions from the public source at github.com/roarbrowser/roar, using this workflow. Nothing built on a personal computer is signed. Each signed file belongs to a tagged release on the releases page.

The Mac app is signed and notarized separately through Apple.

Team roles

• Committers and reviewers: members of the roarbrowser GitHub organization. Every change reaches the main branch through them.
• Approvers: owners of the roarbrowser organization. Each release signature is approved by hand in SignPath.

Third-party code that ships in the Windows build (Chromium through CEF, uBlock Origin Lite, Chrome DevTools MCP and their dependencies) comes from its upstream projects at pinned versions, verified by checksum where the upstream publishes one.

Privacy

Roar is a web browser, so it connects to the sites you open. Beyond that, it sends nothing to its makers: no analytics, no telemetry and no accounts. It only reaches other services on your behalf, for features you can turn off:

• Pull requests in the sidebar, through your own GitHub CLI login.
• Unread mail in the sidebar, through the Gmail login you already have in Roar.
• “Ask about this page”, which opens the AI chat site you picked.

The Windows build does not check for updates by itself yet. Chromium, which Roar is built on, can still reach Google services of its own, such as spell-check dictionary downloads.

Reporting a problem

If you find a signed file that didn't come from a release here, or anything else wrong with a signature, open an issue.