Kepos / Optional reference

Verify a downloaded release

Kepos publishes three platform artifacts, a SHA256SUMS manifest, and its SHA256SUMS.minisig signature for each stable release. Verify the signed manifest before trusting any digest.

01 / Authenticity

Verify the Minisign manifest

Download the public key from the Kepos source tag or another trusted project copy. The checked-in key is release/minisign.pub; a signature failure means the manifest must not be trusted.

Keep the release files together

Download kepos-android-arm64.apk, kepos-macos-arm64.zip, kepos-windows-x64.zip, SHA256SUMS, and SHA256SUMS.minisig from the same stable GitHub release. Save release/minisign.pub separately from a trusted source.
Check the signature

Run Minisign from the directory containing the manifest and signature:
```
minisign -Vm SHA256SUMS \
  -x SHA256SUMS.minisig \
  -p /path/to/kepos/release/minisign.pub
```
Stop if Minisign reports an invalid signature, an unknown key, or a different public-key fingerprint than expected.

02 / Integrity

Check every artifact digest

After the signed manifest passes, compare all three downloaded artifacts with its matching entries. The command must report a match for every file you intend to open.

macOS or Linux

shasum -a 256 -c SHA256SUMS

If your system does not provide shasum, calculate a SHA-256 digest with its standard tool and compare the lowercase hexadecimal output with the corresponding line in SHA256SUMS.

Windows PowerShell

Get-FileHash .\kepos-windows-x64.zip -Algorithm SHA256
Get-FileHash .\kepos-android-arm64.apk -Algorithm SHA256
Get-FileHash .\kepos-macos-arm64.zip -Algorithm SHA256
Get-Content .\SHA256SUMS

Compare each Hash value with the matching artifact line in the manifest. Windows users only need to compare the artifacts they downloaded, but every comparison must match exactly.

03 / Continue safely

Install only after both checks pass

Do not open or install an artifact when Minisign or SHA-256 verification fails. Re-download the complete set from one stable release and repeat the checks instead of accepting a platform warning as proof of authenticity.

Once the files pass, return to the Kepos user guide for platform installation, publisher setup, pairing, and troubleshooting. The release procedure in the repository remains the maintainer reference for certificate and packaging checks.

Keep the release files together

Check the signature

macOS or Linux

Windows PowerShell