Skip to content
zidane
Get started

Verify a download

Check a file from zidane.si/dl against its SHA-256 and the signed release manifest.

Every release at https://zidane.si/dl lists its files in latest.json: the name, platform, URL, SHA-256 and size of each one. The release signs that list with minisign. The install script, Homebrew and the apps' updates check both for you. This page checks a file by hand.

The public key#

minisign.pub
untrusted comment: minisign public key 1DB3EB4F08611FDE
RWTeH2EIT+uzHQnG7U5bcHFzskL0m++wKuc3U5zEom2+tRn/8UukIDGk

The same key is in the install script and in the apps. A manifest signed by another key is not from the zidane release.

Check a file#

  1. 1

    Get the manifest and its signature

    Terminal
    curl -fsSLO https://zidane.si/dl/latest.json
curl -fsSLO https://zidane.si/dl/latest.json.minisig

    For the release before the latest, use https://zidane.si/dl/v<version>/manifest.json and its .minisig. The server keeps those two releases only.

  2. 2

    Verify the signature

    Install minisign (brew install minisign, apt install minisign), then:

    Terminal
    minisign -Vm latest.json -P RWTeH2EIT+uzHQnG7U5bcHFzskL0m++wKuc3U5zEom2+tRn/8UukIDGk

    It prints Signature and comment signature verified. Any other output means the file changed after the release signed it: do not use it.

  3. 3

    Compare the checksum

    Read the file's sha256 in the manifest, then hash the file you downloaded:

    Terminal
    jq -r '.artifacts[] | "\(.sha256)  \(.name)"' latest.json   # every file and its SHA-256
shasum -a 256 <file>                                         # macOS
sha256sum <file>                                             # Linux

    The two values must be equal. The download page shows the same SHA-256 next to each file.

macOS signatures#

The desktop app, the zidane binary and the zidane-server binary for macOS are signed with an Apple Developer ID and notarized. To see the signature:

Terminal
spctl --assess --verbose /Applications/Zidane.app
codesign --verify --verbose "$(command -v zidane)"