The app works end to end and is tested from the packaged installer. What
it doesn't have yet is a code signing certificate — and releasing without
one would put a full-screen scare in front of the people it was built for.
Why that matters more here than usual
When Windows meets a program it has never seen from a publisher it has
never heard of, SmartScreen shows a blue
“Windows protected your PC” screen, and hides the
Run anyway button behind a More info link.
That message means “Windows has not seen this file before”
— not “this file is harmful”. But LanderSync is built for people who
were told, correctly, never to click through warnings like that. Handing
them one on the very first screen is a bad way to start.
So the certificate comes first. It's being arranged through
SignPath Foundation, who sign open-source
projects at no cost and keep the key on their own hardware, where no
developer — including this one — can reach it.
Nothing is hidden in the meantime. Every line of source is
already public, the installer is built in the open by GitHub Actions, and
an early build sits on the
releases page
for anyone who wants to look. It just isn't being recommended to anyone
until it's signed.
SIGNING.md
documents exactly what the app connects to and how your Cloudflare key is stored.