HyperDrop

Documentation

Check a download

Confirm that a file arrived whole, and that it comes from HyperDrop.

Contents

Compare the SHA-256

The download pages for Server Management, the command line, Windows, Linux, Android and the server list each file’s SHA-256. Compute it for the file you downloaded and compare:

A match means the file arrived whole. The sum is published on the same site as the file, so it cannot tell you whether the site itself was tampered with. Two checks below do not depend on this site at all: Apple’s notarization on a Mac, and rebuilding the server from its public source. The package key and the Android certificate are worth checking before the first install, against the copies in the server repository’s SECURITY.md on GitHub, which this site does not control: from then on, apt, dnf and Android accept an update only when it is signed with the same key, so a later change to this site cannot swap them silently.

macOS: notarization

HyperDrop for Mac, Server Management for Mac and the macOS command line are signed with HyperDrop’s Developer ID and notarized by Apple, and macOS checks both when it opens them. To check by hand once the app is in Applications:

spctl --assess --type execute --verbose=2 /Applications/HyperDrop.app
codesign -dv /Applications/HyperDrop.app 2>&1 | grep TeamIdentifier

The first command should answer accepted and source=Notarized Developer ID, and the second TeamIdentifier=MG4RZ3LTJ2. For Server Management, use /Applications/HyperDrop Server Management.app.

Linux: the package key

The package repository and every .rpm are signed with HyperDrop’s package key, fingerprint 9D09 3499 BE6A DB30 C38F 3DAE 80AC 6826 B880 0F72. Installed from the repository, apt and dnf check that signature on every update. For a downloaded .rpm:

curl -fsSL https://gethyperdrop.com/keys/hyperdrop-packages.asc | gpg --show-keys
sudo rpm --import https://gethyperdrop.com/keys/hyperdrop-packages.asc
rpm -K <file>.rpm

The first command should show the fingerprint above (gpg prints it without spaces) before you import the key, and the last should answer digests signatures OK. A downloaded .deb or .zip carries no signature of its own: compare its SHA-256, or install from the repository instead.

Windows

The Windows app, Server Management for Windows and the Windows command line are not code-signed, so Windows shows no publisher for them and SmartScreen may warn (HyperDrop on Windows). Compare the SHA-256 before running a download. Once installed, the app checks every update it downloads against HyperDrop’s update key before installing it.

Android: the signing certificate

Every HyperDrop APK is signed with one certificate, and Android installs an update only when it matches the installed app’s. Compare it before the first install, after which Android itself refuses an update signed by any other: Check the signature.

The server: build it yourself

The Linux server binaries are reproducible builds. Each release tagged in the public repository builds, byte for byte, into the binary published here, so building the tag yourself and comparing SHA-256 sums proves that the download is built from the public source. In a checkout of the release tag, platforms/linux/verify-release.sh <version> runs the whole check, and --installed /usr/local/bin/hyperdrop-server adds the binary your own server runs. The one-line installer refuses a binary whose SHA-256 differs from the one it carries, and a server installs an update only when the binary it already runs verifies the update’s release signature.

The .sig files

The .sig beside each Server Management download is the release signature Server Management checks before it installs an update over itself. It is meant for that updater rather than for checking by hand: use the checks above instead.