SubscriptionEspañolDownload

Verify a download

Check that a Tersa file is exactly the one that was published, with sha256 and minisign.

Every release publishes, next to its files:

  • SHA256SUMS: the SHA-256 checksum of every file in the release;
  • SHA256SUMS.minisig and one .minisig per file: minisign signatures made with the Tersa release key.

The download page links all of them, and every file is served from tersa.dev itself.

1. Check the checksum

Put SHA256SUMS in the folder with the file you downloaded, then:

sha256sum -c SHA256SUMS --ignore-missing

It prints OK beside the file. On macOS, use shasum -a 256 -c SHA256SUMS --ignore-missing.

2. Check the signature

A checksum only proves the file matches the list. The signature proves the list (or the file) was made by whoever holds the release key:

minisign -Vm SHA256SUMS -P <public key>
minisign -Vm <file> -P <public key>

The public key is shown on the download page and will also be published in the repository. It has not been generated yet, so there is nothing to check against until the first release.

3. The platform’s own signature

  • macOS: spctl -a -vv /Applications/Tersa.app should say accepted and source=Notarized Developer ID.
  • Windows (PowerShell): Get-AuthenticodeSignature .\Tersa-Setup-<version>-x64.exe should show Status: Valid.
Back toHelp