Verify downloads and packages

Workflow

Download the platform archive and its .sha256 sidecar. Compare the system SHA-256 result with the published digest. Run secretbridge verify-package on the complete extracted directory and stop if verification exits nonzero.

Boundary and checks

Digests detect changes to downloaded bytes; also check the release source and publisher account. Do not copy the executable alone or mix Web assets from another version.

Before downloading

Choose a complete ZIP or tar.gz for your platform and architecture from the product releases, together with its .sha256 file. Read the selected release’s compatibility notes; the website snapshot can lag behind it. Do not combine a binary and Web assets from different versions.

Two-stage integrity check

1. Calculate the archive’s SHA-256 with a system utility and compare it with the selected release and sidecar. Stop if it differs.
2. Unpack the complete directory. Run secretbridge verify-package /absolute/path/to/package using a trusted installed binary or the package’s read-only verification mode; Windows packages contain bin/secretbridge.exe.
3. Continue only after a zero exit status and matching platform, architecture, version, schema and managed file count. install verifies the candidate again.

The package manifest checks every managed file’s length and SHA-256, Web metadata and CycloneDX 1.6 SBOM. The package also includes a source snapshot and third-party license materials. verify-package does not start the broker or read credentials. If it fails, obtain a complete package again instead of editing the manifest or bypassing validation.

Next: first setup · releases.