Verifying a Silex Desktop release

Silex Desktop is free software, and you can prove that the app you downloaded was actually built from the public source code — you don't have to trust our servers or our CI. This matters for a tool that publishes your websites.

Silex Desktop is in alpha. These guarantees already apply to the Linux builds.

There are two independent checks.

1. The binary matches the source (reproducible build)

The Linux builds (.AppImage, .deb, .rpm) are reproducible: anyone can rebuild the exact same binary from the tagged source and compare it. If your rebuild matches the published hash, the release was not tampered with.

git clone --recurse-submodules https://github.com/silexlabs/Silex && cd Silex
git checkout v3.9.0        # the release you downloaded
docker build --no-cache --pull --build-arg TAG=v3.9.0 - < verify.Dockerfile && echo "REPRODUCIBLE OK"

The build runs in the same pinned environment the release was built in (requires Docker), fetches the hash published with the release (SHA256SUMS.inner) and ends with REPRODUCIBLE OK if your rebuild matches — a mismatch makes the build fail.

Why two files? SHA256SUMS covers the installers (download integrity), while SHA256SUMS.inner is the hash of the compiled binary itself — the reproducible unit. The installer wrappers (AppImage, deb, rpm) embed packaging metadata that is not reproducible, so verification targets the binary they contain.

2. Updates are signed by the project (auto-update)

Silex Desktop updates itself in place. Before installing any update it checks that the update is signed by the project's key, so a tampered or malicious update is refused automatically. You can verify that the published update feed is signed by that key:

./scripts/verify-update-signature.sh

(Requires rsign — cargo install rsign2 — or minisign, plus jq and curl.)

Scope

These checks cover the Linux builds. macOS and Windows builds are signed with the platform vendors' mechanisms instead. Full technical details are in scripts/README.md in the source repository.

Funding

This work is part of Silex Desktop, funded by NLnet through the NGI0 Commons Fund, with financial support from the European Commission's Next Generation Internet programme.