Verify what you download.
Check the file hash
Download the file and SHA256SUMS.txt from the same release. Compare the entire 64-character SHA-256 value against the matching filename.
macOS:
shasum -a 256 Maneuler-Vault-0.3.3-mac-arm64.dmg
Windows PowerShell:
Get-FileHash .\Maneuler-Vault-0.3.3-win-x64.exe -Algorithm SHA256
A hash mismatch means stop. A match detects alteration relative to this published manifest; it cannot protect against an attacker replacing both a file and its checksum.
Web build evidence
Two-build web manifest · CycloneDX SBOM · Evidence checksums
The manifest compares two builds in one pinned environment. The SBOM describes the shared workspace’s production dependency lock graph, including dependencies used by other Maneuler apps. It does not inventory native OS frameworks. These local evidence files are unsigned.
Publisher signatures are a separate check
A release cannot become “signed” by adding a badge or a checksum. Apple Developer ID, notarization and store credentials; Windows publisher signing; and Play App Signing need the owner’s enrolled accounts and verified release pipelines. We do not ask users to disable platform protections to treat a preview as trusted.
Provenance workflow prepared, not yet issued
A pinned GitHub Actions workflow is prepared to attest the web manifest and SBOM using
GitHub’s Sigstore-backed artifact attestation service. It has not run for a public Vault
repository here. Its repository identity, protected environment and required reviewers must
be configured before release. Once an attestation exists, verify it against that exact
approved repository with gh attestation verify; no repository identity is
invented on this page.