Verify Anon downloads

# Verify Anon downloads Start at [Anon downloads](https://anon.inc/download). The [release history](https://anon.inc/releases) lists available files, versions, compatibility, SHA-256 hashes, and platform signing information. An unavailable entry is not a download. The desktop wallet is not released through this hub yet. ## Before installing - **Android:** use Google Play or the verified direct APK linked by Anon. Keep your existing wallet installed when updating. If Android reports a signature conflict, stop and contact support; do not uninstall your wallet to bypass it. - **Network Guard on macOS:** use the signed, notarized setup app from the exact [Network Guard release](https://github.com/anondotinc/network-guard/releases) linked by Anon. Its Developer ID publisher is **AHLOOP LLC**, Apple team **G4CUY3UK8U**. Retain Gatekeeper checks. Signing and notarization establish platform checks, not a guarantee that software has no vulnerabilities. - **iOS:** use the [public TestFlight invitation](https://testflight.apple.com/join/vHexvFSM) for now; there is no independent iOS package download here. ## Check the file hash Expand the release's verification details and compare the complete SHA-256 with the downloaded file. On macOS: ```sh shasum -a 256 /path/to/downloaded-file ``` If even one character differs, do not install it. A hash only authenticates a file when you trust the source of that hash. For stronger offline verification, verify the signed release catalog below. ## Anon's release-metadata key Android and Network Guard release catalogs share a dedicated **Ed25519** key. It does not sign Android APKs or macOS applications and is separate from wallet, paymaster, Apple Developer ID, and Google Play signing keys. - Key ID: `anon-releases-2026-09` - Algorithm: Ed25519; detached signatures are **64 raw bytes**, not base64 text. - Public key: [anon-release-metadata.pub](https://anon.inc/.well-known/anon-release-metadata.pub) - Discovery record: [anon-releases.json](https://anon.inc/.well-known/anon-releases.json) - Auditable tooling and pinned key: [Network Guard source](https://github.com/anondotinc/network-guard/tree/master/release) SHA-256 of the public key's **SPKI DER** encoding (not the PEM text): ```text 2f9d96735d7e9640c24c9d46b69cb9a2ad4a54da0b7d61e3694105bd0a00745d ``` Check a downloaded public key with: ```sh openssl pkey -pubin -in anon-release-metadata.pub -outform DER | shasum -a 256 ``` Compare the fingerprint through a separately trusted Anon channel or a previously pinned source revision. A key delivered beside a malicious download cannot prove its own authenticity. The discovery record describes the key; it is not a self-authenticating replacement for your existing trust pin. ## Offline catalog verification Advanced users can review or clone the release tooling and use Node 22+ locally. Normal installation does **not** need Node, a source checkout, or a terminal. Obtain `catalog.json`, `catalog.json.sig`, and `SHA256SUMS` for the selected release. The signature authenticates the exact catalog bytes; do not reformat its JSON. From the reviewed Network Guard source directory: ```sh node release/cli.mjs verify \ --catalog /path/to/catalog.json \ --signature /path/to/catalog.json.sig \ --public-key release/trust/anon-release-metadata.pub \ --sums /path/to/SHA256SUMS ``` Add `--artifacts /path/to/artifact-root` to check the downloaded files too. Preserve the paths printed in the authenticated `SHA256SUMS` under that root. For a GitHub Network Guard ZIP, that is `network-helper/VERSION/BUILD/FILENAME.zip`; keep the catalog checksum file distinct from a GitHub asset's basename-only checksum file. A successful signature check authenticates metadata, including the version, build, file hash, size, download URL, and signing identity. It does not mean the release is available: inspect `channel` and `status`. Test or `unreleased` records are not public production releases. A previously signed record can also be stale; check current withdrawal notices at the release history before installing. Platform signature verification is still required. macOS Gatekeeper and Android package signatures provide different checks from the metadata signature. ## Key changes and suspicious downloads Do not automatically trust a new key because a catalog or download bundle asks you to. Key changes require an explicit trust update, independently confirmed fingerprints, and a published rotation or incident notice. Retain trusted old public keys for historical verification. Never share a seed phrase, wallet key, or signing credential to troubleshoot a download. See [Network Guard setup](https://anon.inc/setup/vpn) for installation help and [Network Guard's security policy](https://github.com/anondotinc/network-guard/blob/master/SECURITY.md) to report a suspected vulnerability privately.