Security & verification
You can check the software you download from here. This page explains how, and is equally clear about what we have not done.
How downloads are published
- A file only becomes downloadable once a real, available asset is recorded against a published release. Until then, the product page says so.
- Where a SHA-256 digest exists for a file, it is printed on the downloads page beside the file name, with a copy-to-clipboard button.
- Checksum and signature files are linked only when they have actually been produced.
- Files served from another host are labelled as external on the page before you click, so the destination is never a surprise.
Verifying a download yourself
- Download the file and compare its size with the size shown on the downloads page. A mismatch is the earliest warning sign.
- Compute the SHA-256 digest of the file you received. On macOS or Linux:
shasum -a 256 <filename>On Windows PowerShell:Get-FileHash <filename> -Algorithm SHA256 - Compare the result with the digest published on the downloads page. They must match exactly.
- If no digest is published for a file, there is nothing to verify it against. Say so in a report rather than assuming the file is fine.
What we have not done
No independent security audit, penetration test or third-party certification has been carried out on this site or on any product published through it. We make no claim of one. Where a product has a published telemetry disclosure it comes from the project's own records, not from an outside assessment.
Reporting a security problem
A useful report contains the product name, the version you downloaded, the digest you computed, what you expected to happen, and what happened instead.
No dedicated security address is configured yet, so there is no monitored channel to promise you. We would rather say that than point you at an inbox nobody is watching.