Distribution · Operations

Publishing a checksum is not the same as publishing a build

A download page that offers a file without its hash asks the visitor to trust the pipe. The hash is the part that makes the offer checkable.

Last updated September 28, 2026

September 18, 2026 · Distribution · Operations · 5 min read

Distributing desktop software means distributing a binary that runs with the user’s privileges. The visitor has no way to read the source, and no way to know whether the bytes that arrived are the bytes that were published. A checksum is the only part of that exchange they can verify.

What each artifact carries

ClearFrame’s download page lists, for every artifact: the version, the byte count, and a SHA-256 digest. The macOS distribution is a disk image, and the processor selector chooses between the Apple silicon build and the Intel build. The page reports the state of each rather than presenting a uniform grid.

Two entries on the same page make the point better than a policy sentence would. The Apple silicon disk image is described as signed and notarized. Intel Mac downloads are described as temporarily unavailable, with a note about what to do if an older installation times out while updating. Those are different facts about different artifacts, and collapsing them into one "Download for Mac" button would be the easy lie.

Large files, assembled from parts

The artifact manifest this site publishes records the current macOS disk image as 1.15.9, 302,738,861 bytes, stored as 37 parts of 8,388,608 bytes each. The distribution exceeds what a single static asset may be, so it is split into fixed-size pieces and streamed back as one download. That affects what "the file" means: the visitor receives a single file assembled by the server from the stored parts, and the digest on the page is of the assembled result.

The download worker supports HTTP range requests across those parts, which is what allows a download to resume. A resumed download is a case where a checksum earns its place twice: it confirms the file is correct after an interruption that the visitor cannot audit.

Preview builds are labelled

Portable Windows and Linux archives are published as desktop previews. Signing and notarization are not configured for them, and the page says so before offering the download rather than in a footnote after it.

The distinction is operational, not pedantic. A signed and notarized build has been through an operating-system verification path; an unsigned preview has not, and the user’s machine will say so when they open it. A page that did not distinguish them would produce a support conversation about a security warning that the product itself caused.

The page states its own limits

The download page carries the platform states in the same register as the capabilities: Windows and Linux marked as refreshed packages being prepared, iOS marked as beta signups open with public installation not yet available, and the Apple silicon note about update timeouts. None of those are selling points, and all of them are the reason a visitor can make a decision.

What a visitor can check without trusting the page

The point of publishing a digest is that it does not require trusting the page that published it. A visitor can download the artifact, compute its digest with a checksum tool already on their machine, and compare the result with the value on the page. If the values differ, the file is not the file that was described, and no amount of confidence in the vendor changes that. The algorithm is named beside the value on the download page, because a digest without its algorithm is not checkable.

The directory is also listed in a machine-readable manifest that records each artifact's filename, byte count, part size and digest, which is what the download page is generated from. A reader who wants the numbers without the prose can fetch that instead.

Stated limits

A checksum verifies transport, not intent. It establishes that the bytes match the published digest. It says nothing about whether the published digest is for the build the visitor wanted, which is why the version is listed beside it.
Not every artifact is signed. macOS builds are signed and notarized; the Windows and Linux previews are not, and the page says so.
Preview builds are labelled previews. A preview is a real build that has passed a startup check on its native platform, not a release.

Why the platform states differ

A visitor deciding whether to install software is asking a question the page can answer directly or leave them to discover. The download page chooses to answer. Apple silicon is offered as a signed and notarized disk image. Intel Mac downloads are reported as temporarily unavailable, together with the specific advice that an older installation timing out during an update can be replaced by installing the disk image instead.

That last sentence is the kind of detail a page acquires only by supporting the product. It names a real failure — an update that times out — and gives the workaround in the same breath, rather than leaving the visitor with an installer that does not respond.