Verify your download

Verifying the SHA-256 hash of the downloaded .dmg confirms the file hasn't been altered between Cloudflare R2 and your machine. It defends against tampering on untrusted networks and against a hypothetical mirror compromise.

Expected hash

For Montra-0.2.0-beta.3.dmg:

88f45aa805e17d8fbe9cfa3cca54de30589dfbb1572e769c9fa8953eb3ca44ab

Verify command

shasum -a 256 ~/Downloads/Montra-0.2.0-beta.3.dmg

The output should be:

88f45aa805e17d8fbe9cfa3cca54de30589dfbb1572e769c9fa8953eb3ca44ab  ~/Downloads/Montra-0.2.0-beta.3.dmg

Code signing

macOS Gatekeeper automatically verifies Montra's developer signature and notarization ticket the first time you launch the app. Hash verification is an extra check — Gatekeeper is the primary integrity signal for macOS users.