Updates and signatures

Updates and channels

Application and plugins have separate channels. macOS uses DMG for installation and updates.

Alpha

The newest test builds, which may change quickly.

Beta

More functionally complete builds intended for broader testing.

Stable

Verified releases intended for normal use.

Verify signature and file

Download the package and its .asc file from the same release details. Check the public key fingerprint through an independent trusted channel, import the key and run gpg --verify. Then compare the complete SHA-512 with the catalog. Do not run the file if verification fails or values differ. Replace <file> with the actual filename.

Application updater and APT repository — existing key

pub (SC): 0D92 778A D8EC F85C 80E3 9248 48F2 433A D9CD F453
sub (S): F3EA 1875 CBCF 63C8 9B2E D897 4402 8841 DE4E C7E4

Public OpenPGP key · ch-j-signing-public.asc

gpg --show-keys --with-subkey-fingerprint ch-j-signing-public.asc

Signing .deb packages during builds — new separate key

pub (SC): BC75 DC9E 5757 88C7 4189 5E82 D7F2 C5F4 7535 F7D7
sub (S): F503 5C4D 5F8E 139C 507B 00CA DEB3 6BB0 DE62 F640

Public OpenPGP key · ch-j-deb-signing-public.asc

gpg --show-keys --with-subkey-fingerprint ch-j-deb-signing-public.asc

Public OpenPGP key · Release archive

gpg --show-keys --fingerprint ch-j-signing-public.asc
gpg --import ch-j-signing-public.asc
gpg --verify <file>.asc <file>

Calculate SHA-512 for your system:

# macOS
shasum -a 512 <file>
# Linux
sha512sum <file>
# Windows PowerShell
Get-FileHash -Algorithm SHA512 <file>

The OpenPGP signature verifies the distributed file. It does not replace a trusted Windows publisher signature or Apple notarization; alpha releases may therefore trigger system warnings.

Open all releases