Trust

Verify your download.

Anyone can publish a file. These are the commands that prove the one you downloaded is the one we built.

Why a checksum alone is not enough

A SHA-256 proves a file arrived intact. It does not prove who made it: whoever could replace an installer could replace the checksum list in the same action, and both would still match. So we sign the checksum list itself, and publish the key here rather than next to it.

What the signature covers

One signature over SHA256SUMS covers every artifact in the release, because that file lists them all: installers, the CLI binaries, every platform.

Why the key is on this page

The signature and checksums are on GitHub. The key is here. Forging a download means compromising both, not one.

If verification fails

Do not install it. Tell us at [email protected] and we will confirm what the current release should be.

The Sparcle release signing key

Ed25519, via minisign (brew install minisign, apt install minisign). This key signs the checksum manifest of every Bolt release.

RWR074VTKBGzGWsQbnByhGrH9pQG5uHOJSgqL8rs5Zu4GQAxZ1C+JIza

If this key ever changes we will say so here and explain why. A key that changes without explanation is a reason to stop and ask us.

Verifying, step by step

Signed checksum manifests begin with the next release. This key is published ahead of it deliberately. A key that appears at the same moment as the first signature it validates gives you nothing to have trusted beforehand. Releases before that carry SHA256SUMS but no signature, so step 3 works on them and step 2 does not.

1. Download the checksums and the signature

Both live on the release you downloaded from. SHA256SUMS lists a SHA-256 for every installer and CLI binary in that release; SHA256SUMS.minisig is our signature over that file.

curl -LO https://github.com/Sparcle-LLC/sparcle.app/releases/latest/download/SHA256SUMS
curl -LO https://github.com/Sparcle-LLC/sparcle.app/releases/latest/download/SHA256SUMS.minisig

2. Check the signature against our key

This is the step that proves origin. If it fails, stop. The checksums themselves cannot be trusted, so verifying against them would be meaningless.

minisign -Vm SHA256SUMS -P 'RWR074VTKBGzGWsQbnByhGrH9pQG5uHOJSgqL8rs5Zu4GQAxZ1C+JIza'

3. Check your download against the checksums

Only once the signature verifies. On macOS and Linux, shasum reads the manifest and reports OK for the file you have.

shasum -a 256 --ignore-missing -c SHA256SUMS

What we do not yet claim

Being straight about the current state is more useful to a security reviewer than a reassuring summary.

macOS Gatekeeper

Bolt is not yet notarized by Apple, so macOS will not vouch for it natively and our installer clears the quarantine attribute during install. That is a step you should normally be suspicious of, which is exactly why we are naming it. Apple Developer enrollment is in progress; when it completes, builds will be signed with an Apple-issued Developer ID and notarized, and that step disappears. Until then, the signature verification above is the strongest assurance we can offer, and it does not depend on Apple.

Windows SmartScreen

Windows builds are not yet signed with an Authenticode certificate, so SmartScreen may warn on first run. A certificate is in procurement. The checksum signature above verifies Windows downloads today, independently of SmartScreen.

In-app updates

Updates delivered inside Bolt are separately signed and verified by the app against a key built into it, so an update cannot be swapped even if a release were altered. That is automatic and needs nothing from you.