Check that a download is genuine

What is signed and what isn’t

• From v0.5.5, each GitHub release carries a list of fingerprints, SHA256SUMS.txt, and the author’s signature on that list, SHA256SUMS.txt.sig. The v0.5.6 release carries seven files: PocketRoles-<version>.zip (the mod), PocketRoles-Setup-<version>.zip (the launcher), three zips whose names start with Source- (the source code of BepInEx and other parts, attached as their licences require; you don’t need them to play), SHA256SUMS.txt (the fingerprints of those five zips) and SHA256SUMS.txt.sig (the author’s signature on that list).
• The “Source code (zip)” and “Source code (tar.gz)” entries at the bottom of the release page are added by GitHub itself.
• The signing key is RSA 3072-bit / SHA-256, keyid 91400fdf0f5af4ca.
• There’s no Windows code signing (Authenticode) yet. That’s why “Windows protected your PC” appears the first time you open it (details).
• The current launcher doesn’t check SHA256SUMS.txt by itself when downloading. It’s only checked when you follow the steps below.

Checking the fingerprint

The official fingerprints are in two places.

• On the release page, the sha256: value shown next to each file. The page shows only the beginning of it; the copy button next to it (two overlapping squares) copies the whole value. Use the value next to the file, not a value written in the release notes.
• The line with the same file name in SHA256SUMS.txt in the same release.

1. From the same GitHub release, download the zip (and SHA256SUMS.txt if you compare with it).
2. Open PowerShell (search for it in the Start menu).
3. Type Get-FileHash and a space, drag the zip you downloaded into the window, and press Enter.
4. If the Hash shown matches the sha256: value next to the file (the part after sha256:) or the line with the same file name in SHA256SUMS.txt, it’s the same file that was published on GitHub (upper or lower case doesn’t matter). Pasting the two on two lines in Notepad makes them easy to compare.

PS> Get-FileHash drag the zip here

This shows the download wasn’t damaged and that it’s exactly the file in the list. Whether the list itself came from the author is checked with the signature (the checking tool is tools/sign-definitions.ps1 in the PocketRoles source).