WinSTTVerify Release Downloads
Check that a WinSTT macOS, Linux, or Windows release asset matches what the GitHub release workflow uploaded.
Confirm that the package you downloaded matches the artifact published by the WinSTT release workflow. Current alpha releases publish downloadable packages for macOS Apple Silicon, Linux x64, and Windows x64.
Alpha signing status
The current alpha packages are downloadable release artifacts, but updater metadata, detached signature sidecars, notarization, and platform code-signing are not fully wired for every OS yet. Treat the GitHub Release and its workflow run as the source of truth.
What to verify
| Platform | Current artifact pattern |
|---|---|
| macOS Apple Silicon | WinSTT_<version>_aarch64.dmg |
| Linux x64 | WinSTT_<version>_amd64.AppImage / WinSTT_<version>_amd64.deb / WinSTT-<version>-1.x86_64.rpm |
| Windows x64 | WinSTT.exe / WinSTT-portable.zip |
Download from one place only
Pull every asset from the GitHub Releases page. Mirrors and re-uploads can't be matched against the release digest.
Verify in three steps
Compute the file's SHA-256
Run the hashing command for your platform against the file you downloaded.
Get-FileHash .\WinSTT.exe -Algorithm SHA256shasum -a 256 WinSTT_0.1.3-alpha.4_aarch64.dmgsha256sum WinSTT_0.1.3-alpha.4_amd64.AppImageCompare it to the release digest
Match the digest against the
sha256:digest shown for that asset in GitHub's release metadata. With the GitHub CLI:gh release view v0.1.3-alpha.4 \ --repo dahshury/WinSTT \ --json assets \ --jq '.assets[] | {name, digest}'Verify provenance from the workflow run
Each alpha release is produced by the repository release workflow. From the release page, open the linked workflow run and confirm that the platform build jobs and the final upload job succeeded. The expected jobs are:
Build macOS bundle artifacts (aarch64)Build Linux bundle artifactsBuild Windows portable artifactsUpload assets to GitHub release
If verification fails
Do not run the package
Re-download it from the GitHub Release, then compare the digest again. If it still differs, open an issue with the asset name, size, SHA-256 value, and the release URL.