Repository navigation
Downloads and Verification
Caution The only official sources are the GokuTrap repository and its releases. Other websites offering "GokuTrap" downloads are not controlled by the maintainers.
- Releases — github.com/gokuthug1/GokuTrap/releases. Each release publishes a Windows x64 executable built by CI.
- Source — clone the repository and build it yourself. See Building-from-Source.
GokuTrap's own updater performs integrity checks before replacing your installation. It selects a deterministic Windows x64 asset and verifies:
- the asset is a genuine PE executable for x64, not a renamed archive or script;
- the download length matches what the release API reported;
- the published SHA-256 digest, when the release provides one.
When all checks pass, GokuTrap performs an atomic file replacement and keeps a copy of the previous executable as GokuTrap.exe.rollback in the installation folder. See Application-Updates for the full flow and recovery instructions.
The SHA-256 digest is published through the same GitHub API response as the asset itself. It therefore proves that the bytes you received are consistent with what the release metadata described — it is not an independent publisher signature. It cannot detect a compromised release upload.
When a release publishes no digest, GokuTrap falls back to HTTPS transport, length checks and executable-format validation, and says so in the UI rather than implying a stronger guarantee than it has.
Every release is produced by the repository's GitHub Actions workflow on a windows-latest runner. The same workflow:
- checks out the repository including submodules,
- restores and builds in
Release, - runs the automated verification suite (see Verification-Harness),
- publishes the single-file executable and uploads it as a build artifact.
The publish job stamps the executable with the commit SHA and ref, so a build can be traced back to the exact source revision.
If you want to confirm an executable before running it:
- File properties — the Product name should be GokuTrap and the description should reference Roblox.
- Digital signature — releases are not code-signed, so Windows SmartScreen may prompt on first run. Choose More info → Run anyway only if you downloaded from the official release page.
- Size — a single-file .NET executable is a few megabytes. A file that is unexpectedly tiny is a sign you did not get the release asset.
- No bundled copyrighted audio. The "Instant Transmission / Super Saiyan" sound theme is a definition only — you supply your own licensed files. See Sound-Packs.
- No elevation helper, driver or service.
- No credentials, cookies or tokens of any kind.