Why checksums and not vibes
A SHA-256 digest proves the file on your disk is byte-identical to the file the maintainer produced. It does not prove the maintainer is trustworthy — that is what reading the source and the project's history is for — but it eliminates the entire class of tampered-download and hijacked-mirror problems.
· 6 steps
Step 1: download from the repository, not from a search result
Every app page on this site links to github.com/storytold releases. If you arrive at a download page some other way, check that the URL host really is github.com before you click anything. Several sites in this niche present themselves as the official source.
Step 2: get both files from the same release
Take the installer and the SHA256SUMS.txt listed under the very same release tag. Mixing a current checksum file with an older binary tells you nothing.
Step 3: compute and compare
The digest must match exactly, character for character. If it does not, delete the file and find out why before opening it.
| OS | Command |
|---|---|
| Windows | certutil -hashfile photocraft-0.9.0-windows-x64.msi SHA256 |
| macOS | shasum -a 256 photocraft-0.9.0-macos-universal.dmg |
| Linux | sha256sum photocraft-0.9.0-linux-x86_64.AppImage |
| Linux (verify whole set) | sha256sum -c SHA256SUMS.txt |
Step 4: record what you installed
Keep a line per tool in your own notes: app, version, URL, digest, date. Six months later, when a plugin breaks or an audit asks what produced a deliverable, that single line saves an afternoon.
And the signature question
Code signing and notarisation coverage on smaller open-source releases varies by build, which is why Gatekeeper or SmartScreen may complain. That is not evidence of malware — but neither is it a reason to click through. Verify the checksum, and if the warning persists, check the project's issue tracker for the release in question.