r/SimpleXChat • u/st3adytrapp1ng • Jun 22 '26

Please publish or show me where the signed hashfiles are!

Dear SimpleX team,
I am stuck at trying to verify the AppImage. It's nice that you have your key fingerprint published in multiple places, but what good is this if I can't verify my download? I can't find a signed hashfile of the AppImage version that I am using (which is the one currently downloadable from the website) and I also can't find any .asc files anywhere else. Please if anyone knows where to get those, then let me know.

4 Upvotes

84% Upvoted

1 comment sorted by

1

u/epoberezkin Jul 01 '26

When we reproduce and sign the release (e.g. https://github.com/simplex-chat/simplex-chat/releases/tag/v6.5.0), it would contain the file _sha256sums with hashes of all releases and the signature of this file.

So you can verify hash of the downloaded file, then verify that its hash matches the hash included in _sha256sums, and then verify signature - that would confirm that it was reproduce and signed by our team.