Release Verification

Release Verification

Every release ZIP on the Releases page is accompanied by:

• SHA256SUMS — SHA-256 checksums for all release files
• SHA256SUMS.asc — detached GPG signature over SHA256SUMS

Verify the checksum

After downloading, check the file integrity:

# Linux / macOS
sha256sum --check SHA256SUMS

# Windows (PowerShell)
Get-FileHash bethesda-strings-editor-*.zip -Algorithm SHA256
# compare the output hash against the matching line in SHA256SUMS

Verify the GPG signature

Import the release signing key (one-time setup):

gpg --keyserver keyserver.ubuntu.com --recv-keys <KEY_ID>

Then verify:

gpg --verify SHA256SUMS.asc SHA256SUMS

Expected output:

gpg: Good signature from "Bethesda Strings Editor Release Key <...>"

A Good signature result confirms that:

1. SHA256SUMS was not tampered with after it was signed
2. The file was signed by the holder of the private key corresponding to the published public key

What to do if verification fails

• Checksum mismatch — the file was corrupted in transit. Delete and re-download.
• Bad signature — do not run the file. Report the issue at github.com/0xra0/bethesda-strings-editor/issues.

Running from source

If you run from source (via python main.py) rather than a pre-built release, verification is not needed — you can inspect the code directly and trust your own Python environment.