SHA-256 checksums
Download checksums.txt from the same GitHub Release and compare the exact asset name and digest.
shasum -a 256 <download>
# compare with checksums.txtDownload integrity
Verify a Switchyard download
Treat the GitHub Release, cryptographic digest, platform identity, attestation, and SBOM as separate evidence. Reject a package when required evidence is missing or inconsistent.
macOS signing and notarization
Both commands must succeed and identify the expected publisher before first launch.
codesign --verify --deep --strict Switchyard.app
spctl --assess --type execute --verbose Switchyard.appWindows Authenticode
Require a Valid status and review the signer certificate rather than accepting filename or download location alone.
Get-AuthenticodeSignature .\Switchyard_*.msi | Format-ListLinux signatures
Use the maintainer key published with the release. A missing signature is shown as unavailable, never implied.
gpg --verify <download>.asc <download>GitHub artifact attestations
GitHub verifies that the subject digest belongs to an attestation produced by the repository release workflow.
gh attestation verify <download> --repo dcuellar322/switchyardSBOM inspection
Match the SBOM filename and release tag to the asset, then inspect components and hashes before policy checks.
jq . <download>.cyclonedx.json | lessUpdater signatures
Platform signing does not replace updater signing.
Release desktop bundles include Tauri updater artifacts signed by the embedded updater key. Switchyard rejects an update payload without a valid updater signature even when the operating-system package signature is valid.
Package managers
Verify the package record against the stable release.
Homebrew and WinGet methods appear on this site only when their published version matches the reviewed stable GitHub Release. Inspect the package manifest URL and SHA-256, then compare the installed version with switchyard version. Direct signed downloads remain available as the fallback.