Verify a download

Compare the checksum of the disk image and ask macOS about signature and notarization before you trust a copy of FOLD.

Gatekeeper already checks signature and notarization when you first open FOLD. The commands below let you check a copy yourself, for example before you open it or when you received it from someone else. They run in Terminal and need no extra tools.

1. Compare the checksum

The download page lists the SHA-256 of the DMG for the current release. Compute the checksum of your file:

shasum -a 256 ~/Downloads/FOLD-<version>-<build>.dmg

All 64 characters must match the value on the download page. If they differ, delete the file and do not open it. A published version is never replaced, so the checksum of a given file name never changes.

2. Check the disk image

spctl --assess --type open --context context:primary-signature -vv ~/Downloads/FOLD-<version>-<build>.dmg

The expected result is accepted, with source=Notarized Developer ID and origin=Developer ID Application: Datargo GmbH (JSCCM2C266).

3. Check the installed app

After moving FOLD to your Applications folder, ask Gatekeeper about the app itself:

spctl --assess --type execute -vv /Applications/Fold.app

Again you should see accepted, source=Notarized Developer ID and the Datargo GmbH origin.

Then let codesign verify that no file in the app bundle has been changed since it was signed:

codesign --verify --deep --strict --verbose=2 /Applications/Fold.app

The output ends with valid on disk and satisfies its Designated Requirement. To see who signed the app:

codesign --display --verbose=2 /Applications/Fold.app

Look for Authority=Developer ID Application: Datargo GmbH (JSCCM2C266) and TeamIdentifier=JSCCM2C266.

If a check fails

Do not open the app and do not override the warning. Delete the copy, download it again from the download page and repeat the checks. If the fresh copy fails as well, please report it to security@datargo.com.

Automatic updates are additionally verified against a signing key built into FOLD; see Updates on the Mac.