Release verification

Verify release downloads before running an app that will hold real secrets.

What to verify

• Same release Download the application and its platform checksum file from the same GitHub release page.
• Correct filename Compare the checksum line for the exact APK or archive you downloaded.
• Visible version Check Settings, then About, after install or web deployment.
• Recovery available Confirm recovery material is available before replacing an existing installation.

Verify an Android APK

1. 1
   Download release assets.

   Download gitvault-vX.Y.Z-universal.apk and SHA256SUMS.txt from the same release.

2. 2
   Calculate the hash.

   On Windows use certutil -hashfile gitvault-vX.Y.Z-universal.apk SHA256. On macOS or Linux use sha256sum gitvault-vX.Y.Z-universal.apk.

3. 3
   Compare exactly.

   The calculated SHA-256 value must match the APK filename in SHA256SUMS.txt.

4. 4
   Install only after a match.

   If the values differ, delete the file and download again from GitHub Releases.

Verify a Desktop archive

Download the archive and its matching checksum file into one directory. Compare the archive hash before extraction.

# Windows PowerShell
Get-FileHash -Algorithm SHA256 gitvault-vX.Y.Z-windows-x64.zip
Get-Content SHA256SUMS-windows.txt

# Linux
sha256sum -c SHA256SUMS-linux.txt

# macOS
shasum -a 256 -c SHA256SUMS-macos.txt

Verify the web app

1. 1
   Open /app/.

   Use the deployed web app URL, not a stale local build.

2. 2
   Open Settings, then About.

   The version should match the latest release tag after GitHub Pages finishes deploying.

3. 3
   Reload if needed.

   If the old version remains, wait for Pages deployment and reload the browser tab.

When verification fails

• Checksum mismatch Delete the download and fetch it again from the release page.
• Missing asset Wait for the release workflow to finish, then refresh the release page.
• Old web version Check GitHub Pages deployment status and reload after the deploy completes.