Verify Your Download

Every release publishes a SHA-256 checksum for each file and a Sigstore signature proving which build produced it. Neither is much use if nobody explains how to check them, so here is how.

Check the checksum

This confirms the file arrived intact and matches what we published. Download SHA256SUMS into the same folder as the installer, then:

Windows (PowerShell)

Get-FileHash .\VerusPDF-windows-x64.exe -Algorithm SHA256

Compare the printed hash against the matching line in SHA256SUMS.

macOS

shasum -a 256 -c SHA256SUMS --ignore-missing

Linux

sha256sum -c SHA256SUMS --ignore-missing

You want OK next to your file. Anything else means the download is not the file we published — delete it and fetch it again.

Check the signature

A checksum proves the file matches the list. The signature proves the list came from our release pipeline and not from someone who replaced both. Every artifact ships with a .sig and a .pem alongside it, produced by keyless signing during the build, and you can verify one with cosign : 

cosign verify-blob \
  --certificate VerusPDF-linux-x64.AppImage.pem \
  --signature   VerusPDF-linux-x64.AppImage.sig \
  --certificate-identity-regexp '^https://github.com/jonrare/verus-pdf/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  VerusPDF-linux-x64.AppImage

The identity flags are the part that matters. They assert the signature was created by a workflow in our repository — without them you have only proved that somebody signed it.

Platform signatures

On top of the above, each platform has its own signing story:

  • Windows — builds carry an Authenticode signature, which is what stops SmartScreen treating the installer as unknown. Right-click the file, then Properties → Digital Signatures, to see it.
  • macOS — the app is ad-hoc signed so it launches on Apple Silicon, but it is not yet notarised by Apple. Gatekeeper will therefore ask you to confirm the first launch. Checksum verification is the meaningful check here.
  • Linux — the AppImage has no platform-level signing scheme, so the checksum and the Sigstore signature are the whole story.

File names

Current release files, each with a .sig and .pem beside it:

  • Windows — VerusPDF-windows-x64.exe
  • macOS — VerusPDF-macos-universal.dmg
  • Linux — VerusPDF-linux-x64.AppImage