Software Release Security

• Release Governance — Each Release is managed according to Product, Version, Platform, Release ID/Version, and the applicable release status.
• PUBLISHED is the official release state — Internal builds, test builds, release candidates, or unapproved Artifacts are not considered official customer releases.
• No rebuild after release freeze — An Artifact frozen for release must be identified by the applicable Version/Digest/Checksum. An approved Artifact must not be independently rebuilt and still treated as the same release.
• Code Signing — Release Packages may be signed using Platform-appropriate Code Signing mechanisms to support publisher and integrity verification.
• Package Verification — Before installation or Update, a Package may be checked using signatures, metadata, Digest/Checksum, or Release information appropriate to the Platform.
• Artifact Integrity — Release components are controlled to ensure that distributed Artifacts are the approved Artifacts and have not been substituted or changed outside the release process.
• Immutable identification — An official Release must have appropriate immutable identifiers such as Version, Release reference, Digest, or Checksum for verification and traceability.
• Platform-specific publishing — Windows and macOS use Platform-specific Packages; Android is published through Google Play; iOS/iPadOS is published through the Apple App Store.
• No cross-Platform Package distribution — A Package for one Platform is not an official Package for another Platform.
• Release Verification — Vietnam Office may verify Product, Version, Platform, Release status, and Artifact identity before allowing Download, Update, or Activation.
• Secure Update Path — Updates are distributed only from official Releases and must match the customer's Platform and Version Entitlement.
• Release Notes — Release Notes record Version, Release Date, Platform, key changes, Fixed Issues, Security Updates, and Known Issues to support transparency and traceability.
• Security Release — When a Release addresses a security issue, Vietnam Office may publish the importance and Update guidance through a Security Update or Release Notes.
• Do not use Artifacts outside the release system — Customers should not use internal builds, test builds, unofficially shared Packages, or Artifacts whose release source cannot be verified.
• Release traceability — Vietnam Office maintains relationships between Releases and required information such as Platform, Version, Package, Artifact identity, and release status to support verification when needed.

Release Security principle: controlled build → immutable Artifact identification → verification/Code Signing → approval → PUBLISHED status → distribution through official channels → Package Verification before or during installation/Update.