Recluse

Verify your download

A SHA-256 checksum is a fingerprint of a file. If the fingerprint of the file you downloaded matches the one on this page, you have exactly the file that was published, and nobody changed it on the way.

The checksums are served from this site. The files come from a separate download server, so a file that was swapped there won’t match. It takes about a minute.

Checksums for version 0.2.0

Windows installer

Recluse-Setup-0.2.0-x64.exe106 MB (111,430,925 bytes)

SHA-256

553cfe98518aed7fc69be09caee7724a646032d3d818081d5d6301256b32c086

Check it in PowerShell. It prints True if the file matches. How to open PowerShell

(Get-FileHash .\Recluse-Setup-0.2.0-x64.exe).Hash -eq '553cfe98518aed7fc69be09caee7724a646032d3d818081d5d6301256b32c086'

Windows portable

Recluse-Portable-0.2.0-x64.exe106 MB (111,212,687 bytes)

SHA-256

8f43ab860d80b3e29f77b4d2b9b91299891d8bd61c18dbcb425c537135b2c24f

Check it in PowerShell. It prints True if the file matches. How to open PowerShell

(Get-FileHash .\Recluse-Portable-0.2.0-x64.exe).Hash -eq '8f43ab860d80b3e29f77b4d2b9b91299891d8bd61c18dbcb425c537135b2c24f'

Android app

recluse-0.2.0-release.apk24 MB (25,357,993 bytes)

SHA-256 of the file

8dd07010abeea3fec37a62947a8aaa875e7973f84d99c789691d521357f17080

SHA-256 of the signing certificate (the same for every version)

c2ff39b7adc1e483fe0f98dfafc16c3afd55dced142c9fb60ce7c91e0cb30210

Check the file on a Windows PC: open PowerShell where the APK is and run this. It prints True if the file matches.

(Get-FileHash .\recluse-0.2.0-release.apk).Hash -eq '8dd07010abeea3fec37a62947a8aaa875e7973f84d99c789691d521357f17080'

Then check the signing certificate.

All checksums as one text file: SHA256SUMS.txt

Checking a file on Windows

  1. Open the folder with the file you downloaded, usually Downloads.
  2. Click the address bar at the top of the window, type powershell and press Enter. A PowerShell window opens in that folder.
  3. Copy the PowerShell command for your file from the list above, paste it into the window (right-click pastes) and press Enter.
  4. If it prints True, the file is genuine. If it prints False, or an error that the file can’t be found, check the file name. Still False? Don’t open the file.

To see the checksum itself instead, use (Get-FileHash .\file-name).Hash in PowerShell, or this in Command Prompt, and compare it with the one above. Capital letters don’t matter.

certutil -hashfile Recluse-Setup-0.2.0-x64.exe SHA256

Checking the Android signing certificate

Every Recluse APK is signed with the same private key. The certificate’s SHA-256 above stays the same for every version, so it shows that an APK really comes from Recluse, even after the file’s own checksum changes with an update.

  1. On a computer with the Android SDK, use apksigner from its build-tools folder:
    apksigner verify --print-certs recluse-0.2.0-release.apk
  2. Find the line with certificate SHA-256 digest and compare the code after it with the signing certificate above.

On the phone, Android does this check for you on every update. It remembers the certificate the app was first installed with and refuses any update signed with a different one. If an update fails with “App not installed” or “conflicts with an existing package”, don’t uninstall Recluse to get around it: that deletes your messages, and the update may not be genuine. Download it again from this site and check it.

If something doesn’t match

  • Don’t open or install the file. Delete it.
  • Type get.freedomwithrahi.trade into the address bar yourself and download the file again.
  • If it still doesn’t match, don’t use it until a new release is published.

On a Mac or Linux computer

On a Mac, open Terminal in the download folder and compare the output with the checksum above:

shasum -a 256 <file>

On Linux, put SHA256SUMS.txt next to your downloads and run this. Each file should say OK.

sha256sum -c --ignore-missing SHA256SUMS.txt