Integrity
Check the tool before you trust it.
The client tool mints your access tokens, so it should be verifiable without taking our word for anything. Everything you need to check a package against us — rather than against itself — is on this page.
Why the binaries are not code-signed
Our executables carry no Authenticode signature. That is a decision, not an omission.
An Authenticode certificate is a recurring payment to a certificate authority, and what it buys is mainly the absence of a warning dialogue. It establishes that a company paid for a certificate — not that the file you hold is the file we built. A published checksum establishes exactly that, costs nothing, and can be checked by anyone at any time.
So we publish the hashes here instead, and sign the list they live in. The trade is one extra minute during installation, once, against a permanent dependency on a third party we would rather not have between you and the code.
What Windows will show you
Because the executable is unsigned, Windows SmartScreen shows a blue "Windows protected your PC" dialogue the first time you run it. This is expected and is not a sign that anything is wrong with the download — it is the warning we chose over the certificate. Verify the checksum first, then:
- 1.Click "More info" in the dialogue.
- 2.Click "Run anyway".
Verifying a package
Each package contains a SHA256SUMS file listing a hash for every file it holds, and a SHA256SUMS.asc detached signature over that list. The signature proves the list came from us; the hashes prove the files match the list. Check both — hashes alone only prove the download was not corrupted in transit.
Linux and macOS
From inside the extracted package:
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMSWindows (PowerShell)
Compare the printed hash against the table below:
Get-FileHash .\nns-tokens.exe -Algorithm SHA256Current release
These are the authoritative values. A copy of them inside the package cannot vouch for that package — that is the whole reason this page exists.
No public release has been published yet. Once the first package ships, its checksums appear here. Until then, take the values from the SHA256SUMS file delivered with your package and verify its signature against the key below.
Our signing key
Import it once, on any machine that will verify our packages, and check the fingerprint against the value below before relying on it. Compare it here rather than against the copy printed inside the download.
- Fingerprint
- EA4C A32E 7D05 A97A D934 DF14 E2B8 015B 507A 02E5
- UID
- DemandFlow Release Signing <releases@negative-news-search.com>
If something does not match
Stop and do not run the tool. A failed signature or a hash that differs from the table means the package is not the one we published, and no amount of retrying makes it safe. Get in touch — we will tell you what the correct values are and where the package should have come from.