Checking a download
Make sure a file you downloaded is exactly the one Refora Technologies published.
Every release file has a SHA-256 checksum published beside it: a .sha256 file for each one, and SHA256SUMS listing them all, on the releases page. If the checksum of your download matches, the file is exactly the one published.
The apps’ own updates are checked like this by themselves. This is for the first download, if you want to be sure.
On Windows
In PowerShell, in the folder you downloaded to:
Get-FileHash .\Basalt-Host-Setup.exe -Algorithm SHA256Compare the long number it prints with the one in Basalt-Host-Setup.exe.sha256. Upper and lower case don’t matter.
On Linux
Download SHA256SUMS into the same folder as your file, then:
sha256sum --check --ignore-missing SHA256SUMSIt says OK beside each file you have.
On a Mac
shasum -a 256 Basalt-Android.apkThe Docker image
The image is signed, and carries a record of the GitHub workflow that built it from the public source. With the GitHub CLI:
gh attestation verify oci://ghcr.io/refora-technologies/basalt-host:latest --owner refora-technologiesIf it doesn’t match
Don’t install it. Download it again, from this website or the releases page only. If it still doesn’t match, please tell us.
Something unclear, or not covered here? Ask in Help and setup, where the community and Refora Technologies answer, or write to us, and we will improve this page.