Verify your download

Every release lists the SHA-256 of each file in SHA256SUMS.txt, and each file carries GitHub build provenance: a signed statement of the workflow run and commit that built it.

Checksum

Download SHA256SUMS.txt from the same release, then compare:

shasum -a 256 -c SHA256SUMS.txt --ignore-missing

Build provenance

With the GitHub CLI:

gh attestation verify Teitunnel_0.1.0_universal.dmg --repo teispace/teitunnel

It succeeds only for a file built by Teitunnel's release workflow from this repository.

Signatures

• macOS: the app is signed by Teispace and notarized: spctl -a -vv /Applications/Teitunnel.app should say source=Notarized Developer ID.
• Windows: this beta isn't code-signed yet (see the code signing policy).
• Updates are verified by the app itself against the key built into it, before they're installed.