Home / Verify a download

Verify a download

Two checks. The SHA-256 fingerprint shows the file arrived complete and undamaged. The signature proves it really came from me: it is made with a key that never touches this web server, so even someone who broke into the site couldn't fake it.

1. Check the signature (recommended)

Install minisign (Linux: from your package manager; Windows and macOS: from its website). Put the download and its .minisig file in the same folder, then run:

minisign -Vm the-file-name.zip -P RWS5a/BfXSiWFQr+mhyaDqwO4Lhv1wPqrJbRrflWa9Zmt4eE2ayaxH9n

It must say Signature and comment signature verified. My release key (ID 1596285D5FF06BB9) is:

RWS5a/BfXSiWFQr+mhyaDqwO4Lhv1wPqrJbRrflWa9Zmt4eE2ayaxH9n

You can also download it as a file: sos-minisign.pub. If a signature fails, don't run the file, and tell me on X.

2. Check the SHA-256 fingerprint

Linux

sha256sum the-file-name.zip

macOS

shasum -a 256 the-file-name.zip

Windows (PowerShell)

Get-FileHash .\the-file-name.zip -Algorithm SHA256

Compare the long string it prints with the one on the download page. Every character must match. If even one is different, delete the file and download it again.

The fingerprint is shown on this same website, so on its own it only proves the download wasn't damaged. The signature is what proves it came from me.