MacWinlink Product Lifetime and Security Update Policy

This document states ARSFI's commitment to providing security
updates for MacWinlink. It is a companion to the security policy
at SECURITY.md and the coordinated-vulnerability-disclosure
policy at CVD_POLICY.md.

Statement effective from: MacWinlink V1.0.0 general
availability release.
Governing regulation: EU Cyber Resilience Act (Regulation
(EU) 2024/2847), Article 13(8) — expected product lifetime.

Summary

• Current major version (V1.x once released, and each future
  V2.x, V3.x, and so on) receives security updates for at least
  five (5) years from the general availability date of that
  major version's .0 release.
• When a new major version ships, the immediately preceding
  major version enters a twelve (12) month sunset window
  during which it continues to receive security-only updates
  while users migrate. After the sunset window, the prior major
  version reaches end-of-life and receives no further updates.
• Feature updates ship on the current major version only.
  Bug fixes, new radio support, protocol enhancements, and other
  non-security changes do not backport to prior major versions
  after their sunset window has begun.

The 5-year floor meets the EU Cyber Resilience Act Article 13(8)
guidance for expected product lifetime. ARSFI may extend support
beyond the stated minimum on a case-by-case basis but does not
commit to doing so in advance.

Two applications, two update channels

MacWinlink comprises two applications with different distribution
channels but the same support-lifetime commitment:

• MacWinlink (main app, bundle identifier
  org.arsfi.macwinlink): distributed through the Mac App Store.
  Updates ship as new App Store versions. Users must actively
  install App Store updates for security fixes to reach them.
• MacWinlink Helper (bundle identifier
  org.arsfi.macwinlink-helper): distributed as a signed and
  notarized disk image from the MacWinlink downloads area on
  winlink.org. Users must actively download and install updated
  Helper releases for security fixes to reach them.

Users who do not install the security updates we ship cannot
expect security fixes to reach them, regardless of the support
window this policy states. This mirrors how amateur radio
equipment maintenance works generally: the operator is responsible
for keeping their station current.

Runtime-managed components

MacWinlink Helper coordinates the installation of several
third-party components that it does not itself distribute:

• Wine — LGPL-2.1-or-later; staged into the Helper's Wine
  prefix from an upstream stable build.
• VARA HF and VARA FM — proprietary Winlink modems by EA5HVK
  (Jose Alberto Nieto Ros); downloaded by the Helper from the
  vendor's distribution site.
• Direwolf — GPL-2.0-or-later; installed via brew install direwolf at the Helper's prompt.
• Hamlib — LGPL-2.1-or-later; installed via brew install hamlib at the Helper's prompt.

For these components, ARSFI's commitment is best-effort: when a
security-relevant upstream release is available, the Helper's
version resolvers or update prompts are updated in the next Helper
release to reflect it. ARSFI does not make guarantees about the
security posture of these upstream components themselves — those
guarantees belong to the upstream projects and (for VARA)
vendors. A full list of runtime-managed components is included
in each release's Software Bill of Materials (SBOM).

Timeline example

To illustrate the policy concretely, assuming V1.0.0 ships on
1 January 2027:

Because V1.x is committed to security updates through 2032-01-01
regardless of when V2.x ships, and because the V1.x sunset window
of 12 months extends past the V1.x minimum-support floor only if
V2.x ships after 2031-01-01, the effective V1.x end-of-life date
is whichever of (V1.0.0 + 5 years) or (V2.0.0 + 12 months) is
later. Users are never worse off than five years of security
support on the version they installed.

What "security update" means

For the purposes of this policy, a security update is:

• A patch that addresses a vulnerability tracked under our
  Coordinated Vulnerability Disclosure policy (see
  CVD_POLICY.md); or
• A fix for a defect that we have reasonable grounds to believe
  is being actively exploited; or
• A change required by our upstream dependencies (Apple's macOS
  APIs, Swift language runtime, bundled Wine, etc.) to remain
  functional in a security-relevant capacity.

Bug fixes with no security implication, protocol enhancements,
new radio support, UI improvements, and other non-security work
are not security updates and are not subject to this policy's
timelines.

Changes to this policy

Material changes to this policy will be published at
https://downloads.winlink.org/User%20Programs/MacWinlink/ and noted in
release notes. Changes will not shorten the security update
window for versions already placed on the market. If we
extend the support window for a specific version, we will announce
that separately.

Legal note

This policy states ARSFI's commitment as the manufacturer under
the EU Cyber Resilience Act. It is not a warranty and does not
create additional obligations beyond those imposed by applicable
law. Users in jurisdictions with stronger consumer protection
laws retain those rights.

Last revised: 2026-08-24.