Skip to content

Verify a download

Every installer on an Alcuin release is built by GitHub Actions from a tagged commit, and each one carries a signed build-provenance attestation. You can check that the file you downloaded is the one the release workflow produced, before you open it.

Terminal window
gh attestation verify Alcuin-0.1.0-arm64.dmg --owner alcuin-app

A passing result names the workflow, the commit and the repository that built the file. A failing result means the file was changed after the build, or was never built by the release workflow: do not install it.

The same works for the macOS zip and the Linux AppImage and deb. There is no Windows installer yet: it comes in v0.1.x, once it is signed. Each release also attaches a CycloneDX SBOM listing every dependency in the build, with the Electron, Chromium and Node versions it ships and the packages bundled into its files.

On macOS the app is also signed with Alcuin’s Developer ID and notarized by Apple, and the DMG is notarized and stapled. To check that as well:

Terminal window
spctl -a -vv /Applications/Alcuin.app

It should say accepted and source=Notarized Developer ID.

Check a checksum

Section titled “Check a checksum”

Each release also lists the SHA-256 checksum of every file it publishes, in SHA256SUMS-macos.txt and SHA256SUMS-linux.txt. Download the list for your platform into the folder that holds your installer, then check the files you have against it:

Terminal window
shasum -a 256 -c --ignore-missing SHA256SUMS-macos.txt   # macOS
sha256sum -c --ignore-missing SHA256SUMS-linux.txt       # Linux

Each of your files should be listed with OK. Anything else means the file is not the one the release published: don’t install it.

A checksum shows the file arrived as the release published it. The attestation above also shows which workflow and commit built it.