Skip to content
beebeeb.io docs

Verify a download

Check what you downloaded before you run it.

CLI releases: SHA-256

Section titled “CLI releases: SHA-256”

Every CLI release publishes a sha256.sum file with the SHA-256 checksum of each archive, on its GitHub release page. Download it next to your archive, then:

Terminal window
shasum -a 256 -c sha256.sum --ignore-missing

On Linux you can use sha256sum instead:

Terminal window
sha256sum -c sha256.sum --ignore-missing

A line ending in OK for your archive means it matches. Anything else: do not run it.

Desktop apps: minisign

Section titled “Desktop apps: minisign”

Update artifacts of the desktop apps carry a minisign signature: a sibling .sig file next to the Windows NSIS and MSI installers, the Linux AppImage, deb and rpm packages, and the macOS .app.tar.gz, on the desktop GitHub release page. Verify with minisign:

Terminal window
minisign -Vm <artifact> -P <public key>

The public key and its key ID are published on the download page, not copied here, so there is one place to check.

What this proves

Section titled “What this proves”

A matching checksum or signature shows the file is the one that was published. It does not show the published code is what you expect: for that, read the source. The clients are open source, see Open source.