Verify your download
Every Wipter release is signed. Windows and macOS builds are signed and notarized using each platform's own tools, and your operating system checks that automatically when you install. Linux builds are additionally signed with our private signing key, which you can verify by hand — this page focuses on that manual check.
This is optional. If you skip it, the app still verifies its own updates automatically against a key built into it.
Windows and macOS: already verified by your system
Our Windows installer is code-signed and our macOS app is signed and notarized by Apple. Your operating system checks this automatically — you don't need to run any command.
Windows
Right-click the downloaded .exe, choose “Properties”, open the “Digital Signatures” tab and confirm a signature is listed with no errors. If Windows SmartScreen shows a warning on first run, click “More info” to see the signed publisher before choosing to run it.
macOS
macOS Gatekeeper checks the signature and notarization automatically when you open the .dmg — a properly signed, notarized app opens without warnings. To check it yourself, open Terminal and run the command below; it should end with “accepted”.
spctl --assess --type execute --verbose /Applications/Wipter.app
Linux
These two steps cover any Linux package.
1. Get our public key
Download the key and import it. This is the key our release pipeline signs with. Download the public key
gpg --import wipter-linux-signing-pubkey.asc gpg --fingerprint contact@wipter.com
Expected fingerprint — compare this exact string
135B 6AEA 3965 8678 E1F8 55EC 9F4C 9004 3526 3F10Compare the fingerprint printed by the command with the one shown above. If they differ, stop and contact support — do not install the file.
2. Verify the file you downloaded
Select the package you downloaded.
Download the signature next to the package, then check it against the package.
gpg --verify wipter-app-amd64.deb.asc wipter-app-amd64.deb
Expect a line containing Good signature. You may also see a warning that the key “is not certified with a trusted signature” — that's expected, since you haven't personally signed our key. What matters is the “Good signature” line and the fingerprint matching.
Optional: verify all checksums at once
We also publish a signed list of checksums for every artifact in the release. This lets you confirm a download in one step without fetching an individual signature.
gpg --verify SHA256SUMS.asc SHA256SUMS sha256sum --check --ignore-missing SHA256SUMS
Signature files for this release
wipter-app-amd64.deb.ascwipter-app-arm64.deb.ascwipter-app-x86_64.AppImage.ascwipter-app-arm64.AppImage.ascwipter-app-x64.tar.gz.ascwipter-app-arm64.tar.gz.asc
wipter-app-x86_64.rpm — signature included in the package
wipter-app-aarch64.rpm — signature included in the package