Verifying a download

Every Lithos Translate release lists a checksum for each installer in a file called SHA256SUMS, and signs that file with the Lithos release key. Checking the signature tells you the installer is exactly the one we built. It hasn't been damaged or swapped on the way to you. It's optional: the macOS app is also signed and notarized by Apple, which your Mac checks by itself.

Published here, not only on the release

The signing key

Download the Lithos release key (lithos-release-signing-key.asc). Its fingerprint is:

3599 B466 A71F 19A0 B64D 5137 6D5F 9A9D 747C 04B2

The same key file is attached to every release. This page is the second, independent place it's published: if a release's key doesn't show this fingerprint, don't trust that download. The key is named Lithos Translate Releases and is valid until 12 October 2029. A new key will be announced on this page before then.

macOS and Linux · two minutes

Check an installer

You need GnuPG. Linux usually has it already. On a Mac, install it with brew install gnupg, or install GPG Suite.

Download three files from the release into the same folder as your installer: SHA256SUMS, SHA256SUMS.asc and lithos-release-signing-key.asc.

Import the key and check that the fingerprint it prints matches the one above:

gpg --import lithos-release-signing-key.asc
gpg --fingerprint "Lithos Translate Releases"

Check the signature. Look for Good signature from "Lithos Translate Releases":
```
gpg --verify SHA256SUMS.asc SHA256SUMS
```
gpg may add that the key "is not certified with a trusted signature". That's normal, and it's why step 2 has you compare the fingerprint yourself.

Check the installer. Look for OK next to its name:

# Linux
sha256sum --ignore-missing -c SHA256SUMS
# macOS
shasum -a 256 --ignore-missing -c SHA256SUMS

Windows

On Windows

Install Gpg4win, then run steps 2 and 3 above in PowerShell; the gpg commands are the same. For step 4, print the installer's checksum:

Get-FileHash ".\Lithos Translate Setup x.y.z.exe" -Algorithm SHA256

Then compare it with the line for that file in SHA256SUMS. The case of the letters doesn't matter.

Windows may show "Unknown publisher" or a SmartScreen notice for now. A Windows code-signing certificate is on its way; until then, this check is how you know the installer is ours.

Quick answers

When something's wrong

"BAD signature"

SHA256SUMS has been changed since it was signed, or it belongs to a different release than the .asc file. Download both again from the same release. If it still fails, don't install, and tell us.

The installer says FAILED

The file is damaged or isn't the one we published. Download it again; an interrupted download is the usual cause.

"No properly formatted checksum lines found" or nothing says OK

Run the command in the folder that holds both the installer and SHA256SUMS, and keep the installer's original file name.

A check failed or something looks off? Write to support@lithos.community. We'd much rather hear about it than have you install something doubtful.