1. What is signed
The Windows programs of HidraVPN, the network's VPN, are signed with an Authenticode certificate issued to SignPath Foundation under its free programme for open-source projects:
hidravpn.exe, the client;hidravpn-service.exe, the service that holds the tunnel;hidravpn-sign.exe, the tool that checks a download against its published signature.
The Windows build of the HidraNet Browser is to be signed under this same policy.
The Wintun network driver (wintun.dll) that HidraVPN uses on Windows is not ours. It is shipped exactly as its authors publish and sign it, and is not signed again.
HidraVPN is in preview. Releases published before signing was in place are not signed.
2. How a file gets signed
- Only files built by the project's GitHub Actions workflow (
.github/workflows/hidravpn-build.yml), from the public source at github.com/NeurexBK/HidraNet, are signed. Nothing built on a developer's computer is. - SignPath checks that the files came from that build of that repository before it signs them.
- The certificate's private key is held in SignPath's hardware security module and is never exported. It is never in the repository, on a build runner or on anyone's computer.
- Signing requests are made only from the main branch and from release tags, never from a pull request or another branch, and nothing is signed until an approver (section 3) approves the request in SignPath.
- Nothing is added to the programs during the build or the signing: no telemetry, no tracking, no extra code.
3. Team roles
| Role | Who |
|---|---|
| Committers and reviewers | The repository's owner, NeurexBK, and the maintainers it grants write access. Every change reaches the source as a pull request and is reviewed before it is merged; outside contributions are reviewed the same way. |
| Approvers | NeurexBK. No file is signed without this approval. |
4. Privacy
The signed programs do not transfer any information to other networked systems unless the user, or the person installing or operating them, asks them to.
- The client and the service connect only to the VPN nodes the user chooses to use, to be admitted and to carry the tunnel, and, when the user gets or buys passes, to the pass issuer named in the signed node list.
- The download checker makes no network connection at all.
- None of them sends telemetry, crash reports or usage statistics.
What the network as a whole processes is in the privacy policy.
5. Checking a file
On Windows, right-click a file, choose Properties and open Digital Signatures: a signed HidraVPN file names SignPath Foundation as the signer. Separately, every release is published with a manifest that lists each file's SHA-256 hash and is signed with the project's own release key; the browser checks both before it installs anything.
6. Reporting a problem
If you find a signed file that you believe we did not build, or a signature used in a way this policy does not allow, write to contact@hidranet.pro. Code questions are welcome as issues at github.com/NeurexBK/HidraNet/issues.