Skip to main content
Security is critical when installing software that handles your Bitcoin. KaleidoSwap releases can be verified through several layers:
  • A SHA256 checksum manifest (manifest.txt), signed by the developer with a GPG key held on a hardware security key (YubiKey). The private key never leaves the hardware token.
  • Apple Developer ID signing and notarization on macOS builds, so they install without any security warnings.
  • Tauri updater signatures (.sig files) that the app’s built-in updater verifies automatically before applying an update.
Per-file detached GPG signatures (.asc) for every release binary are planned but not yet published alongside releases. Until then, use the checksum manifest described below to verify your download.

​
Why Verify Downloads?

Verifying a binary before installing ensures:
  • The file was produced and signed by the KaleidoSwap developers
  • The file was not tampered with or corrupted in transit
  • No malicious code was injected after the build

​
What Ships with Each Release

The Releases page publishes an installer for each platform: Releases also include .sig files and a latest.json. These are Tauri updater signatures consumed automatically by the app’s built-in updater — they are not GPG signatures and are not meant for manual verification.

​
SHA256 Checksum Verification

The SHA256 hash for each artifact is listed in the manifest.txt file, available as a build artifact on each CI run. The manifest is signed by the developer with GPG (detached signature manifest.txt.sig), using a key stored on a YubiKey.

​
Prerequisites

  • GPG (GNU Privacy Guard) installed on your system
  • The KaleidoSwap binary you want to verify
  • The manifest.txt and manifest.txt.sig files for the same release

​
1. Import the Developer’s Public Key

This is a one-time step. Import the KaleidoSwap developer’s public GPG key directly from GitHub:
You can verify the key fingerprint after importing:
The key ID you will see in signature output is 9EE396C0452755F0.

​
2. Verify the Manifest Signature

Confirm that the manifest itself is authentic before trusting the checksums inside it:
A good verification looks like this:
The gpg warning “This key is not certified with a trusted signature!” is expected unless you have explicitly set the trust level for this key. The Good signature line is what matters.
If you see “BAD signature” or “No public key”, do not trust the manifest or install the file. Download a fresh copy from the official GitHub Releases page and try again. If the problem persists, open a GitHub Issue or reach out on Telegram.

​
3. Check Your Binary Against the Manifest

Compute the SHA256 hash of your download and compare it with the entry in manifest.txt:
The hash must match the manifest entry exactly. If it does not, delete the file and re-download it.

​
macOS: Additional Platform Verification

macOS builds are also code-signed with an Apple Developer ID certificate and notarized by Apple. You can verify this independently after installation:
A correctly signed and notarized app will show accepted from spctl and no errors from codesign.

​
Automatic Updates

Once installed, the app’s built-in updater downloads new versions and verifies each one against the .sig updater signature published with the release, using a public key embedded in the app. This happens automatically — no manual steps are required for updates.

​
Troubleshooting

If none of the above resolves the issue, contact the team via GitHub Issues or Telegram.

Download the Desktop App

Get the latest KaleidoSwap Desktop App release for macOS, Windows, or Linux.