Trust

Verify your download.

Anyone can publish a file. These are the commands that prove the one you downloaded is the one we built.

Why a checksum alone is not enough

A SHA-256 proves a file arrived intact. It does not prove who made it: whoever could replace an installer could replace the checksum list in the same action, and both would still match. So we sign the checksum list itself, and publish the key here rather than next to it.

What the signature covers

One signature over SHA256SUMS covers every artifact in the release, because that file lists them all: installers, the CLI binaries, every platform, and the CycloneDX SBOM published alongside them.

Why the key is on this page

The signature and checksums are on GitHub. The key is here. Forging a download means compromising both, not one.

If verification fails

Do not install it. Tell us at [email protected] and we will confirm what the current release should be.

An opinion that is not ours

Every release also carries VIRUSTOTAL.md, listing a report link for each installer keyed to that file's own SHA-256, so any independent scan of the exact bytes you downloaded is one click away across roughly seventy engines. We publish the lookup rather than a verdict of our own: the point is that you do not have to take ours.

The Sparcle release signing key

Ed25519, via minisign (brew install minisign, apt install minisign). This key signs the checksum manifest of every Bolt release.

RWR074VTKBGzGWsQbnByhGrH9pQG5uHOJSgqL8rs5Zu4GQAxZ1C+JIza

If this key ever changes we will say so here and explain why. A key that changes without explanation is a reason to stop and ask us.

Verifying, step by step

These three commands work on the current release right now. Older releases carry SHA256SUMS without a signature, so step 3 works on them and step 2 does not; every release from v0.1.140 onward is signed.

1. Download the checksums and the signature

Both live on the release you downloaded from. SHA256SUMS lists a SHA-256 for every installer and CLI binary in that release; SHA256SUMS.minisig is our signature over that file.

curl -LO https://sparcle.app/releases/latest/SHA256SUMS
curl -LO https://sparcle.app/releases/latest/SHA256SUMS.minisig

2. Check the signature against our key

This is the step that proves origin. If it fails, stop. The checksums themselves cannot be trusted, so verifying against them would be meaningless.

minisign -Vm SHA256SUMS -P 'RWR074VTKBGzGWsQbnByhGrH9pQG5uHOJSgqL8rs5Zu4GQAxZ1C+JIza'

3. Check your download against the checksums

Only once the signature verifies. Pull your file's line out of the manifest and let shasum check it, substituting the name of the file you actually downloaded. On macOS and Linux it prints the filename followed by OK.

grep ' Bolt-Enterprise-0.1.150-aarch64-apple-darwin.dmg$' SHA256SUMS | shasum -a 256 -c

Platform trust, and where it stands

Both platform signing paths are in place as of 0.1.150. Neither replaces the verification above, which works today and depends on no one else.

macOS Gatekeeper

Signed and notarized by Apple. Both the .app and the .dmg are signed with Developer ID Application: Sparcle Inc. (4VSW7NBZ2S) and carry a stapled notarization ticket. Check it yourself before installing: spctl -a -vvv -t install against the downloaded .dmg reports accepted and source=Notarized Developer ID. Because the ticket is real, the installer no longer strips the quarantine attribute: it tests for a stapled ticket and leaves Gatekeeper's own provenance in place.

Windows SmartScreen

Authenticode, through an SSL.com EV certificate. The Windows installer is signed with an Extended Validation code-signing certificate issued to Sparcle Inc. and held in a cloud HSM rather than on a build machine, so the signing certificate names Sparcle Inc. as the publisher. The manifest signature above verifies a Windows download independently of SmartScreen as well.

In-app updates

Updates delivered inside Bolt are separately signed and verified by the app against a key built into it, so an update cannot be swapped even if a release were altered. That is automatic and needs nothing from you.

Something not verifying?

If a signature or checksum does not match, do not install it. Tell us and we will confirm what the current release should be.

Email [email protected] Back to Trust Center