Three desktop builds you can download

The numbers

Read off the files, not typed

The version, the size and the SHA-256 beside each build come from the files themselves. They used to be typed in by hand, and a checksum typed by hand is worse than no checksum, because it looks like a guarantee and is really a transcription.

A build with nothing on disk simply does not appear. The page is static and the rows are put in when the site is assembled, so a download section advertising a file nobody uploaded is not a thing that can happen here.

Signing

Ask the artifact, not the environment

The notarisation flag used to be computed from whether notarisation credentials happened to be in the environment when the script ran, which is not a fact about the file. It published false for disk images that were in fact stapled, and it would have published true just as readily for a submission that failed. Having a key is not the same as having used it.

Every claim now comes from interrogating the artifact — codesign -v, stapler validate, apksigner verify — and sits on the row it is true of, because a disk image’s answer and an APK’s answer come from different authorities and one flag spanning both would have to be the weaker of the two while reading as a claim about each.

What that produces today: both macOS disk images are signed and notarised. The Linux AppImage is not signed, and the manifest says so rather than leaving the field out.

The phones

One is sideloadable, the other is not a download at all

An Android APK is built, signed, and verified with apksigner rather than assumed from the fact that a file exists — Gradle produces an unsigned APK when the keystore is missing and it looks identical. Its version number moves, too. It used to be a hard-coded 1, so a second build handed to somebody was refused by the phone with a message that explained nothing.

The iPhone build is not a download. It goes to TestFlight, and getting it there turned up two failures worth naming. Apple’s upload tool prints “UPLOAD FAILED”, names what was rejected, and then exits reporting success — so a refused build was recorded as shipped, and the retry that would have fixed it refused itself as a duplicate. And the project generator wrote a literal build number of 1 that no override could move, so TestFlight showed build 1 while the ledger recorded 128, with nothing objecting anywhere along the way.