{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "jpzk-opensidian--verify-release-download-before-install",
 "repo": "jpzk/opensidian",
 "repo_url": "https://github.com/jpzk/opensidian",
 "repo_slug": "jpzk-opensidian",
 "title": "Check a release download against the signed checksums",
 "page_title": "How to check a release download against the signed checksums with Opensidian",
 "summary": "Confirm the AppImage or package matches the maintainer's signed SHA256SUMS before running it.",
 "who": "A security-minded Linux user or packager who wants to confirm a download was not altered.",
 "problem": "Downloaded binaries can be tampered with, and they need a check before they run on the system.",
 "outcome": "The download is confirmed against the signed SHA256SUMS file, and the signature is checked against the published key.",
 "steps": [
  "Download the file you want, plus SHA256SUMS and SHA256SUMS.asc from the v0.6.2 release page, using `curl -LO https://github.com/jpzk/opensidian/releases/download/v0.6.2/SHA256SUMS`",
  "Import the maintainer key with `gpg --keyserver hkps://keys.openpgp.org --recv-keys A6E69ED6BC4779F3281721484CC1AFDE15B64EA3`",
  "Check the signature with `gpg --verify SHA256SUMS.asc SHA256SUMS`",
  "Check the file hashes with `sha256sum -c --ignore-missing SHA256SUMS`",
  "Install or run the file only if every checked line reports OK."
 ],
 "agent_prompt": "In the jpzk/opensidian repo, download SHA256SUMS and SHA256SUMS.asc for v0.6.2 into <download-folder>, import the key listed in the README, and run gpg verify and sha256sum -c. Report the gpg verification result and each OK line. Verify that the gpg output shows a good signature from the expected key fingerprint before reporting success.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "The check only proves the file matches what the maintainer published, so it depends on the key being the real maintainer key from the README.",
 "category": "Personal productivity",
 "tags": [
  "Personal productivity"
 ],
 "lang": "rust",
 "requirements": [
  "A Linux x86_64 machine (the README lists Linux x86_64 only)",
  "For the DEB path: a Debian or Ubuntu system with sudo access",
  "For the source build: build tools, WebKitGTK 4.1 development packages, and Rust 1.98.0"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/jpzk-opensidian/verify-release-download-before-install/",
 "md": "https://dedupedai.com/use-cases/jpzk-opensidian/verify-release-download-before-install/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/jpzk-opensidian--verify-release-download-before-install.json",
 "api_version": "v1"
}