Verify your download

Verifying the SHA-256 hash of the downloaded .dmg confirms the file hasn't been altered between Cloudflare R2 and your machine. It defends against tampering on untrusted networks and against a hypothetical mirror compromise.

Expected hash

For Montra-0.1.0.dmg:

411443d39a29cbb0ea134a9012b40225a6d86203693bf83ed0b5a86fae054a78

Verify command

shasum -a 256 ~/Downloads/Montra-0.1.0.dmg

The output should be:

411443d39a29cbb0ea134a9012b40225a6d86203693bf83ed0b5a86fae054a78  ~/Downloads/Montra-0.1.0.dmg

Code signing

macOS Gatekeeper automatically verifies Montra's developer signature and notarization ticket the first time you launch the app. Hash verification is an extra check — Gatekeeper is the primary integrity signal for macOS users.