Skip to content
RSXSoftware
RSX · Software · Help

Verify a download

Every release page lists, for each file, its exact size, its SHA-256 and the identity its platform signature must carry. Checking a download means comparing those with what your system reports.

01

What each check proves

  1. The SHA-256 proves the file is byte for byte the one RSX reviewed and published. Every release is immutable: a version's files never change after publication.
  2. The platform signature proves who built it. For Android and MSIX packages, RSX Registry records the signer of an application's first release and refuses any later release signed by anyone else; your system checks the same signature when it installs.
  3. The signed snapshot, linked from each release page, is the list of every published file and digest, signed with RSX's own application signing keys. RSX applications check it before they install an update; you do not need to.
If any check fails, do not install the file. Delete it and download it again from this site; if it fails again, tell us on Discord .
02

Windows 11

Checksum

In PowerShell, in the folder you downloaded to:

PowerShell
Get-FileHash .\<file> -Algorithm SHA256

The Hash it prints must equal the SHA-256 on the release page. PowerShell prints it in capitals; the comparison ignores case.

Signature

Check the installer's own signature before you run it:

PowerShell
Get-AuthenticodeSignature .\<file> | Format-List Status, SignerCertificate

Status must be Valid. For an MSIX package, the certificate's subject is the publisher the release page lists. Windows shows the same publisher when you open the file; if it says the publisher is unknown, do not install it.

03

Debian 13

Checksum

Shell
sha256sum <file>

The first field it prints must equal the SHA-256 on the release page.

Signature

A Debian package carries no publisher signature of its own. Check the package name it will install as:

Shell
dpkg-deb --field <file> Package Version Architecture

All three must match the release page. The SHA-256 above is what ties this file to the release RSX approved.

04

Android 16

Checksum

Android has no built-in checksum tool. Download the APK on a computer as well and check it there with sha256sum or Get-FileHash, or rely on the signing certificate check below, which Android also enforces for every later update.

Signature

With the Android SDK's build tools on a computer:

Shell
apksigner verify --print-certs <file>

The SHA-256 digest of the signer certificate must equal the signing certificate on the release page, ignoring case and colons. Every release of an RSX application is signed with the same certificate; Android refuses an update signed with any other, and so should you.