# Verify a download

> Check a file from zidane.si/dl against its SHA-256 and the signed release manifest.

Every release at `https://zidane.si/dl` lists its files in `latest.json`: the name, platform, URL, SHA-256 and size of each one. The release signs that list with [minisign](https://jedisct1.github.io/minisign/). The [install script](https://zidane.si/docs/tui.md#install-and-run), Homebrew and the apps' updates check both for you. This page checks a file by hand.

## The public key

```text title="minisign.pub"
untrusted comment: minisign public key 1DB3EB4F08611FDE
RWTeH2EIT+uzHQnG7U5bcHFzskL0m++wKuc3U5zEom2+tRn/8UukIDGk
```

The same key is in the install script and in the apps. A manifest signed by another key is not from the zidane release.

## Check a file

## 1. Get the manifest and its signature

```bash
curl -fsSLO https://zidane.si/dl/latest.json
curl -fsSLO https://zidane.si/dl/latest.json.minisig
```

For the release before the latest, use `https://zidane.si/dl/v<version>/manifest.json` and its `.minisig`. The server keeps those two releases only.

## 2. Verify the signature

Install minisign (`brew install minisign`, `apt install minisign`), then:

```bash
minisign -Vm latest.json -P RWTeH2EIT+uzHQnG7U5bcHFzskL0m++wKuc3U5zEom2+tRn/8UukIDGk
```

It prints `Signature and comment signature verified`. Any other output means the file changed after the release signed it: do not use it.

## 3. Compare the checksum

Read the file's `sha256` in the manifest, then hash the file you downloaded:

```bash
jq -r '.artifacts[] | "\(.sha256)  \(.name)"' latest.json   # every file and its SHA-256
shasum -a 256 <file>                                         # macOS
sha256sum <file>                                             # Linux
```

The two values must be equal. The [download page](https://zidane.si/download) shows the same SHA-256 next to each file.

## macOS signatures

The desktop app, the `zidane` binary and the `zidane-server` binary for macOS are signed with an Apple Developer ID and notarized. To see the signature:

```bash
spctl --assess --verbose /Applications/Zidane.app
codesign --verify --verbose "$(command -v zidane)"
```