Use the official release.
Download from retvest.com/downloads/ or the Retvest GitHub release. The implementation repository is private; the download repository contains public installers, notices and guides.
Compare the checksum.
The SHA256SUMS.txt file lists the SHA-256 hash for each installer. Compare the hash of your downloaded file with the corresponding entry. A match confirms the bytes match that list; the list’s origin still matters.
Understand the signing status.
- Linux: a separate OpenPGP signature is published for the AppImage.
- All platforms: the checksum manifest has a separate OpenPGP signature.
- Mac: Apple Developer ID signing and notarization remain pending.
- Windows: Authenticode publisher signing remains pending.
GPG signature checks do not remove operating-system warnings, validate an independent legal identity or certify that software is safe.
Use the signing guide.
The public verification guide explains the commands and trust limits. The key fingerprint published by Retvest is:
8C21 A0CF 3C63 9636 5F9A 2252 0652 2F43 9578 25FD
Download the public key. Never share a private key or passphrase to verify a download.
Licences and third-party material.
The release includes third-party notices and corresponding source information where supplied. Retvest’s original preview material uses the Sidekick Preview Licence. Third-party licences and rights in earlier GPL copies remain in effect.