How to verify a download is genuine
Verification is the difference between trusting a file and knowing what it is. It takes about a minute. These instructions work for our releases and, with the filenames changed, for anything else you download.
No release exists yet, so there is nothing to verify today. The commands below are exactly what will apply when there is, and they are published now so the process is familiar before it matters.
1. Get the checksums from the release page itself
Every release carries a SHA256SUMS.txt listing each artifact and
its hash. Take it from the release page on the source repository — not from a
mirror, and not from wherever you got the installer.
2. Compute the hash of what you downloaded
Windows (PowerShell)
Get-FileHash -Algorithm SHA256 .\OpenDesktopAuthenticator-Setup.exeLinux or macOS
sha256sum OpenDesktopAuthenticator.AppImageOr check every file at once against the list:
sha256sum --check SHA256SUMS.txt3. Compare
The hash you computed must match the line for that filename exactly. Not "starts with the same characters" — the whole string. If it differs by one character, the file is not the file we published. Delete it.
4. Verify the signature over the checksum file
A checksum proves the file was not corrupted. A signature proves who wrote the checksum. Without step 4, anyone who can replace the download can also replace the list of hashes.
gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txtYou are looking for a good signature from the release key published on the repository. A warning that the key is not certified with a trusted signature is normal and only means you have not personally marked it as trusted; a BAD signature is not normal and means stop.
5. On Windows, check the executable's signature too
Get-AuthenticodeSignature .\OpenDesktopAuthenticator-Setup.exe | Format-List Status, SignerCertificate
Status should read Valid and the signer should be the
publisher named on the release page. An unsigned build, or one signed by a name
you do not recognise, is not ours.
Going further: build it yourself
The strongest check available is not to trust our binary at all. The source is public and the build is reproducible: clone the tag, build it, and compare your artifact's hash with the published one. If they match, the binary on the release page contains exactly the source you just read.