diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md new file mode 100644 index 0000000..e2ae933 --- /dev/null +++ b/CODE_SIGNING_POLICY.md @@ -0,0 +1,72 @@ +# Code signing policy + +[Project home](README.md) · [Downloads](https://github.com/qudadd/envscope/releases) · [Privacy](PRIVACY.md) · [Uninstall](docs/UNINSTALL.md) + +Last reviewed: **2026-10-31**. + +## Current status + +EnvScope is preparing an application for free Windows code signing from the +[SignPath Foundation](https://signpath.org/). **The project has not been accepted +and does not currently receive signing services from the Foundation.** + +The published **0.25.0 Alpha** Windows executables are unsigned. macOS packages +use ad-hoc signing, without Developer ID signing or Apple notarization. File +checksums, application identity checks and successful CI runs do not establish +a trusted publisher signature. The current release remains available with +these limitations explicitly disclosed. + +## People and approval + +The current maintainer is [qudadd](https://github.com/qudadd), who performs the +author, reviewer and release-approver roles. This is a single-maintainer project; +these roles do not imply an independent second reviewer. The maintainer has +confirmed that GitHub two-factor authentication is enabled. + +If the Foundation accepts the project, all repository and signing-service +members must use multi-factor authentication. Signing-service access and its +MFA have not yet been provisioned. Each signing request will require manual +approval by an authorized maintainer after reviewing its source revision, +build result and artifact scope. Changes to maintainers or signing permissions +must be reflected here. + +## Builds and signing scope + +The repository publishes its [desktop build workflow](.github/workflows/desktop.yml), +[checks workflow](.github/workflows/checks.yml), tagged source and release +checksums. Windows and macOS packages are built with GitHub Actions. This is +source-linked build evidence, not a claim of bit-for-bit reproducibility. + +The proposed Windows signing scope is EnvScope's own executable and native +timezone helper built from this repository. Bundled third-party source, +libraries and tools retain their upstream attribution and licenses, documented +in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). We will not submit unrelated +upstream executables for signing as if they were authored by EnvScope. The +Foundation must review the packaging and diagnostic scope before any signing +integration is enabled. + +Approved signing would be integrated into the controlled build before final +archives and checksums are generated. Publisher verification and update checks +also require implementation and validation; publishing this policy does not +activate them. See the remaining work in the [signing guide](docs/SIGNING.md). + +If accepted, the public policy and download pages will identify the signing +service actually used and credit the Foundation. Its certificates identify +**SignPath Foundation**, and use remains subject to its +[Code of Conduct](https://signpath.org/terms), including revocation. No current +binary should be described as signed by the Foundation. + +## Users and project conduct + +Diagnostics are read-only. Repairs, account-profile operations and persistent +maintenance require separate review of their effects and explicit confirmation. +The project provides local diagnostics and configuration management, not +accounts, proxy subscriptions, forged device identities or an assurance of +service eligibility. Its network and proxy-configuration checks are disclosed +for the Foundation's eligibility review. + +External requests, local data and user controls are described in the +[privacy notice](PRIVACY.md). Users can stop scheduled components and remove +the application using the [uninstall guide](docs/UNINSTALL.md). Report a +suspected compromised release through the channels in [SECURITY.md](SECURITY.md); +do not include credentials or private diagnostic files in a public issue. diff --git a/PRIVACY.md b/PRIVACY.md new file mode 100644 index 0000000..df81545 --- /dev/null +++ b/PRIVACY.md @@ -0,0 +1,114 @@ +# Privacy notice + +本说明介绍 EnvScope 读取什么、何时联网、如何保存及移除本地资料。当前软件没有 EnvScope 运营的上传服务器或分析统计服务。 + +Applies to EnvScope **0.25.0 Alpha**. Last reviewed: **2026-10-31**. + +## Local processing + +EnvScope is an open-source Windows and macOS application maintained at +[qudadd/envscope](https://github.com/qudadd/envscope). It has no project-operated +backend, analytics SDK or automatic diagnostic-report upload. The desktop +interface communicates with its own loopback service. Opening a GitHub issue, +following an external link or using a third-party client involves that service +separately. + +Depending on selected checks, EnvScope reads operating-system and application +versions, timezone and locale, selected client settings, DNS and network-route +metadata, proxy configuration, process metadata, disk availability and network +test results. Some checks may be unavailable without OS authorization. Native +diagnostics do not change settings. Repairs and persistent maintenance have +their own effect preview and confirmation. + +Account operations are separate from diagnostics. When explicitly authorized, +they copy or exchange local Claude profile directories, which can contain +cookies, login credentials, identity files and other private state. They do not +upload these copies to EnvScope. OS credential stores are not fully included in +these copies. See [account data and recovery](docs/ACCOUNT_VOLUMES.md). + +## Requests to external services + +Network tests start when the user requests detection, uses a relevant tool, or +enables a maintenance plan that includes those tests. Online command-line probes +require `--online`; native UDP STUN additionally requires `--stun`. + +**The desktop application checks GitHub for software updates by default**, at +startup and periodically while running. This can be disabled in the software +update/background settings. Downloading, installing or restarting into a new +version requires confirmation. Checking for updates is separate from consent +to run diagnostics or maintenance. + +These requests disclose the source IP seen by the recipient and normal request +metadata, such as time, requested host/path and user agent. DNS queries are also +visible to the resolver handling them. Proxy or VPN use may change the source +seen by a destination; it does not make the requests anonymous. + +| Service | Purpose and data sent | Provider information | +|---|---|---| +| Cloudflare | HTTP connection/public-IP observations and UDP STUN; network request metadata | [Privacy policy](https://www.cloudflare.com/privacypolicy/) | +| ipify | IPv4/IPv6 public-IP observations; network request metadata | [API provider website](https://www.ipify.org/) | +| IPinfo | Requested IP-region suggestions and network/ASN information; network request metadata | [Privacy policy](https://ipinfo.io/privacy-policy) | +| Google STUN | Optional native UDP and browser ICE observations; STUN request metadata | [Privacy policy](https://policies.google.com/privacy) | +| Anthropic / Claude | Anonymous service-response checks; network request metadata | [Privacy policy](https://www.anthropic.com/legal/privacy) | +| GitHub | Release/upstream-version checks and requested downloads; requested repository paths and application user agent | [Privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) | +| Optional ecosystem endpoints | Anonymous reachability requests to Cloudflare, Datadog, Segment/Twilio, Stripe and Intercom domains | [Datadog](https://www.datadoghq.com/legal/privacy/), [Twilio](https://www.twilio.com/en-us/legal/privacy), [Stripe](https://stripe.com/privacy), [Intercom](https://www.intercom.com/legal/privacy) | + +The ipify API homepage is linked as provider information, not as a verified +separate privacy-policy page. Third-party policies and retention practices are +controlled by those providers. + +HTTP diagnostic probes do not attach Claude login credentials, browser cookies +or profile files. Ecosystem checks are reachability requests; EnvScope does not +embed those services' analytics SDKs. Browser observations are returned to the +local EnvScope process. A user-specified proxy may receive its supplied proxy +credentials and network requests; custom command-line targets contact the +destinations selected by the operator. + +Optional temporary browser sessions run an installed browser with a separate +profile. Websites the user visits receive ordinary browser traffic; they are +not covered by a promise of anonymity. Explicit upstream installation/update +tools also have their own behavior and permissions, disclosed separately. + +## Files, retention and sharing + +Application preferences, recent diagnostic history, recovery backups, update +packages, browser-session records and maintenance logs are normally stored +under `~/.envscope` in the current user's home directory. Account slots and +some upstream-compatible state use `~/.claude-switcher`. Separately authorized +privileged timezone services store their protected state at the fixed system +paths listed in the [timezone service guide](docs/TIMEZONE_SERVICE.md). + +Normal diagnostic history keeps the latest 50 redacted records. A local random +HMAC key enables address-change comparison without saving plain addresses in +that comparison record. This is not complete anonymization: system details and +user-entered settings, such as permitted address ranges, can still identify the +environment. Operators can explicitly request sensitive local CLI output with +`--include-sensitive`. Daily event logs and recovery backups are retained for +review and recovery; they are not all automatically deleted with old history. + +**Original configuration backups and directory-based account copies are not +encrypted and may contain secrets.** They are excluded from normal diagnostic +exports. Optional encrypted account archives have their own password and format +requirements; they do not encrypt every application file. Temporary browser +cleanup removes eligible files after the authorized session closes, but failed +cleanup retains data for a later retry. Deletion is not guaranteed secure erasure. + +Diagnostic reports and support bundles use best-effort redaction, not a guarantee +that all sensitive information has been removed. Review every file before +sharing it. Do not upload account slots, raw backups, browser profiles, tokens +or proxy credentials to a public issue. + +## Your controls and contact + +You can choose applicable tests, turn off automatic update checks, decline a +repair, and disable approved maintenance. User maintenance, the optional process +guard and the privileged timezone service are separate components; closing the +window does not disable them. See [uninstall and data removal](docs/UNINSTALL.md) +for stopping them, restoring supported changes and removing local files. + +Privacy questions can be raised with the maintainer through the project's +[issues](https://github.com/qudadd/envscope/issues) without including private +data. For security-sensitive reports, follow [SECURITY.md](SECURITY.md). The +project has no central copy from which to retrieve or delete your local data. +This notice is versioned in the public repository and should be updated when +data handling changes. diff --git a/README.md b/README.md index e68e722..ea5a7cf 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,8 @@ 当前 Windows 包未进行发布者签名；macOS 包使用 ad-hoc 签名，尚未进行 Developer ID 签名或 Apple 公证。首次打开可能被系统拦截。下载校验与签名是不同的验证，详见 [开源构建与更新](docs/OPEN_SOURCE_BUILDS.md)、[正式签名准备](docs/SIGNING.md)。 +[Code signing policy](CODE_SIGNING_POLICY.md)：正在准备 SignPath Foundation 开源签名申请，尚未获批或接入。另见 [隐私说明](PRIVACY.md)、[卸载与资料移除](docs/UNINSTALL.md)。 + ## 四步使用 1. **确认目标**：填写实际使用地区，读取出口 IP 建议节点国家与城市，匹配时区和地区格式。实际所在地与代理出口分别记录。 @@ -62,7 +64,7 @@ - 地区预设不等于 Claude 支持地区。修改时区、语言或节点不改变实际所在地，也不保证账号安全或服务端设备判断。 - 诊断只读；修复、账号切换和守护分别审核。配置原文备份可能含凭据，请勿上传；分享诊断包前也应复核。 -权限、平台与真实设备的验证范围见 [验收记录](docs/DESKTOP_ACCEPTANCE.md)；数据处理边界见 [SECURITY.md](SECURITY.md)。 +权限、平台与真实设备的验证范围见 [验收记录](docs/DESKTOP_ACCEPTANCE.md)；数据处理见 [隐私说明](PRIVACY.md)，实现边界见 [SECURITY.md](SECURITY.md)。 ## 与 claude-switcher 的关系 diff --git a/SECURITY.md b/SECURITY.md index 81941ee..0d58735 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,9 @@ # Security and privacy boundaries +For data handling, external services and user controls, see the +[privacy notice](PRIVACY.md). For stopping background components and removing +local data, see the [uninstall guide](docs/UNINSTALL.md). + ## Reviewed configuration remedies Diagnostics do not change system or client settings. A separate reviewed plan @@ -153,9 +157,10 @@ privilege, backup and rollback behavior. Their bundled hashes verify provenance, not native-device acceptance. Installers can register background services and the macOS original updater. Original output is marked unverified by EnvScope. -Local history and preferences are under `~/.envscope`; no raw addresses are -stored there by the normal UI. Comparison uses a private random HMAC key and -does not infer IP ownership or risk. Loss of that key invalidates comparisons. +Local history and preferences are under `~/.envscope`. Normal diagnostic history +redacts observed addresses; user-entered settings, including permitted address +ranges, may still contain addresses. Comparison uses a private random HMAC key +and does not infer IP ownership or risk. Loss of that key invalidates comparisons. Redaction is best effort, not a guarantee of anonymization. ## Reporting an issue diff --git a/docs/README.md b/docs/README.md index e71f9ee..0c8cc53 100644 --- a/docs/README.md +++ b/docs/README.md @@ -13,6 +13,7 @@ | 选择项目、全选、批量修复 | [可选检查](SELECTIVE_CHECKS.md) · [检查偏好](CHECK_PREFERENCES.md) | | 查明问题、了解检测证据 | [检测与处理](DIAGNOSIS.md) · [环境覆盖](ENVIRONMENT_COVERAGE.md) · [逐项检查](CLAUDE_CHECKS.md) | | 确认权限问题和软件能力边界 | [权限验收与限制](PERMISSION_ACCEPTANCE.md) | +| 了解联网与数据处理、停止后台组件及卸载 | [隐私说明](../PRIVACY.md) · [卸载与资料移除](UNINSTALL.md) | | 比较原项目、平台和实现范围 | [完整功能对照](FULL_PARITY_AUDIT.md) | ## 修复与长期保持 @@ -44,7 +45,7 @@ | 命令行、策略、报告与证据解释 | [CLI](CLI.md) | | 模块与安全边界 | [架构](ARCHITECTURE.md) · [安全与隐私](../SECURITY.md) | | 桌面与权限测试的已验证 / 待验证范围 | [桌面验收](DESKTOP_ACCEPTANCE.md) · [权限验收](PERMISSION_ACCEPTANCE.md) | -| Windows 签名、Apple 签名与公证所需条件 | [正式签名准备](SIGNING.md) | +| Windows 签名、Apple 签名与公证所需条件 | [正式签名准备](SIGNING.md) · [Code signing policy](../CODE_SIGNING_POLICY.md) | | 界面与交互原则 | [桌面设计](UI_DESIGN.md) | | 参考项目、固定版本与许可 | [源码研究](RESEARCH.md) · [来源与许可](../THIRD_PARTY_NOTICES.md) | diff --git a/docs/UNINSTALL.md b/docs/UNINSTALL.md new file mode 100644 index 0000000..71bc198 --- /dev/null +++ b/docs/UNINSTALL.md @@ -0,0 +1,71 @@ +# 卸载与本地资料移除 / Uninstall + +[项目首页](../README.md) · [隐私说明](../PRIVACY.md) · [文档目录](README.md) + +EnvScope 的独立包通过解压运行。卸载前先停止已经批准的后台组件，再退出并删除程序。以下操作均由用户选择；本说明不会执行删除。 + +## 1. 保留需要的资料，处理待恢复操作 + +- 如需保留账号槽位、历史或配置备份，先复制到自己的安全位置。原文备份可能含凭据，普通目录复制不提供加密。 +- 账号切换若提示“待恢复”，先在账号页完成恢复或保留全部恢复现场，不要直接删除目录。 +- 如需撤销已做的配置修改，趁应用仍可运行时使用对应的预览撤销 / 恢复入口，并核对结果。删除软件不会自动恢复系统时区、语言、网络或客户端设置。无法自动撤销的项目按原方案手动处理。 + +## 2. 分别停止后台组件 + +在“更多功能 → 持续维护”中检查已启用的组件，并确认停用结果： + +| 组件 | 卸载前操作 | +|---|---| +| 周期巡检与批准基线恢复 | 停用持续维护，确认不再执行修复 | +| 可选进程守护 | 单独停用进程守护，确认其任务已停用 | +| 系统时区守护 | 在系统时区服务入口预览并确认移除；需要恢复首次安装前时区时，在该方案中选择恢复，并按系统提示授权 | + +**关闭主窗口、退出应用或停用普通巡检，都不会自动移除单独授权的系统时区服务。** 任务移除失败、权限不足或仍有待恢复操作时，保留程序和日志，先按界面提示处理。受组织策略管理的电脑应由管理员协助。 + +如果曾明确安装原版维护核心，它的后台任务也可能独立存在。在旧组件管理中核对归属和停用方案，或按原版的卸载说明处理；不要将第三方任务一并删除。 + +## 3. 关闭临时浏览器并退出 + +关闭由 EnvScope 启动的临时浏览器窗口，在“工具 → 临时浏览器”执行“清理已关闭的临时浏览器资料”，确认没有仍在使用或待重试的资料。无法确认已退出时先保留，不删除日常浏览器目录。 + +通过托盘或 macOS 菜单栏的退出入口结束 EnvScope；只点窗口关闭按钮可能仍会驻留后台。确认没有仍运行的 EnvScope 工作进程后再移除程序。 + +## 4. 移除程序与可选本地数据 + +| 系统 | 程序文件 | +|---|---| +| Windows | 删除你解压得到的 EnvScope 程序文件夹及自行创建的快捷方式 | +| macOS | 将你解压或放入应用程序目录的 `EnvScope.app` 移到废纸篓 | + +软件更新可能把新版本保存在用户目录的 `.envscope/updates/versions` 下；完成停用和退出后，才可将这些旧程序副本一并移除。不要删除系统 WebView、Python、代理客户端或其他应用共享的运行环境。 + +默认保留本地数据便于恢复。如确定不再需要，可在备份后移除下列**属于自己的**目录： + +| 目录 | 包含什么，删除前须确认什么 | +|---|---| +| Windows `%USERPROFILE%\.envscope`；macOS `~/.envscope` | 设置、历史、配置备份、更新副本及维护记录；所有关联任务与临时浏览器应已停止 | +| Windows `%USERPROFILE%\.claude-switcher`；macOS `~/.claude-switcher` | 账号槽位和兼容状态；可能由原版 claude-switcher 共用，仅在确认双方都不再使用且恢复已完成后处理 | + +不要因卸载 EnvScope 而删除 Claude 的当前资料目录，例如 Windows 的 `%APPDATA%\Claude` 或 macOS 的 `~/Library/Application Support/Claude`。 + +系统时区服务的移除会保留受保护的备份和日志。其固定路径见 [时区守护](TIMEZONE_SERVICE.md)。如还需彻底移除这些留存记录，应在服务已移除、恢复已完成后由管理员核实路径再处理，不能先删辅助程序来代替停用服务。 + +移到回收站或废纸篓可留出恢复机会；清空前请再次核对备份。普通删除不等于安全擦除。 + +## English summary + +Before removing EnvScope, preserve any data and recovery records you need, undo +supported configuration changes if desired, and separately disable scheduled +maintenance, the optional process guard and the privileged timezone service. +Use the timezone service's reviewed removal flow and OS authorization; stopping +user maintenance does not remove that service. Resolve pending transactions +before deleting recovery data. + +Close temporary browser sessions, finish their approved cleanup, then quit the +tray/menu-bar application and its workers. Remove the extracted Windows folder +or macOS application. Optionally remove your `.envscope` data and update copies +after stopping all components. `.claude-switcher` may be shared with the original +project: preserve it unless both applications no longer need it. Do not delete +the active Claude profile, shared runtimes or third-party proxy software. +Privileged service backups/logs may remain for administrator-reviewed cleanup. +Removing program files does not undo system changes or securely erase data.