Verify Your Download

Verify your download

1. Checksum. Every release lists SHA-256 values (SHA256SUMS.txt for pre-releases, the release notes for signed Windows releases). Compare:

   • macOS / Linux: shasum -a 256 FILE or sha256sum FILE
   • Windows PowerShell: Get-FileHash FILE -Algorithm SHA256

2. Updater signature (signed releases). The .sig next to the installer is a minisign signature, base64-encoded; the public key is plugins.updater.pubkey in src-tauri/tauri.conf.json, also base64-encoded. With minisign:

   base64 -d < FILE.sig > FILE.minisig
   grep -o '"pubkey": "[^"]*"' src-tauri/tauri.conf.json | cut -d'"' -f4 | base64 -d > chronexus.pub
   minisign -Vm FILE -x FILE.minisig -p chronexus.pub

   The in-app updater performs this check itself and refuses unsigned files.

3. Source. The release notes name the source commit; the tag is annotated.

4. Dependencies. chronexus-VERSION-sbom.cdx.json and -licenses.md, when attached, list every crate and npm package. See docs/TRUST.md.

There is no Authenticode or Apple notarization (no paid certificates): Windows SmartScreen and macOS Gatekeeper warn on first start.