Verify a download

Every release comes with a list of checksums, and that list is signed with the mollusk release key. Checking a download takes two steps.

Windows and macOS

The Windows installer is signed by Mollusk Audio LLC, and Windows shows that name as the verified publisher when the installer starts. The macOS installer is signed with Mollusk Audio LLC's Developer ID and notarized by Apple, and macOS checks both when the installer opens.

Checksums, on any system

Download SHA256SUMS and SHA256SUMS.asc into the folder that holds the installer, and the release key.

Linux and macOS:

gpg --import mollusk-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

On macOS the last command is shasum -a 256 -c SHA256SUMS.

Windows, in PowerShell, then compare the result with the installer's line in SHA256SUMS:

Get-FileHash .\mollusk-1.0.2-windows-x64.exe -Algorithm SHA256

The release key

gpg --verify should name this key:

EAA6 5D9B F4AA E86E 1AFA  AF40 241F 67A3 AAD2 CE7E
Mollusk Audio LLC (release signing) <[email protected]>

Back to home Back to top