Release provenance and checksums
Compare the tag, public source and receipt for the exact release you downloaded.
Identify the download
Section titled “Identify the download”The release page links to the selected public development tag and its exact assets. Avoid assuming the GitHub “latest release” URL selects a prerelease. Use the build number shown in Settings → About to match a running copy to its download.
Read the two source identifiers
Section titled “Read the two source identifiers”The Git tag points to a reviewed clean source snapshot. Its PUBLIC-SOURCE.json records the original build-source revision and export file hashes. The original metadata.json names the commit that built the binary and records package signing and SHA-256 data. The public assets are mirrored byte for byte. They were not rebuilt from the clean Git commit.
Verify your file
Section titled “Verify your file”Follow the download instructions for the DMG or ZIP you selected. SHA256SUMS lists both files in the selected release. A matching hash checks integrity. Apple’s signature and notarization checks are separate.