Security

How Silver Bullet is signed, and how to check that what you downloaded is what Govirang Microspaces Private Limited published.

How the packages are signed

Every package of Silver Bullet is signed by Govirang Microspaces Private Limited with its own release key. It is not signed or notarised by Apple, and not signed by Microsoft or any certificate authority, and we do not intend that to change (EULA clause 10A). So macOS and Windows may warn the first time you open it, and you may need to allow it: the Download page says what to click.

If your organisation allows only software signed by Apple, Microsoft or a public certificate authority, check this during the free trial, before you buy.

The release key

Fingerprint of the release key that signs version 3.0.0-intl-rc.9 and every other release:

559F-A83E-A382-315B

Silver Bullet carries the same key inside it. SilverBullet version prints it on the line Release key; it must be the one above.

Checking a download by hand

This page is served by this website, separately from the download server (https://dl.govirang.com), so a file changed on the download server does not match the checksums here. Compute the SHA-256 of the zip you downloaded:

shasum -a 256 SilverBullet3-desktop-*.zip                    # macOS
sha256sum SilverBullet3-desktop-*.zip                        # Linux
Get-FileHash SilverBullet3-desktop-*.zip -Algorithm SHA256   # Windows

It must match the one below exactly. If it does not, do not install it: download it again, and tell us at [email protected].

System	Package (3.0.0-intl-rc.9)	SHA-256
WindowsWindows 10 and 11 (x64; also runs on Windows on Arm)	SilverBullet3-desktop-3.0.0-intl-rc.9-windows-x64.zip42 MB	`a5346ce055db55a4522f02a78260adb2e594061ea0d5cc6b0220aaaa3b4d681e`
macOS — Apple siliconM1 or later, macOS 11 or later	SilverBullet3-desktop-3.0.0-intl-rc.9-macos-apple-silicon.zip38 MB	`4af87c9a074a9cbb5b5bd93444cfa121a554b2501729311cd64b37d705b90712`
macOS — IntelmacOS 11 or later	SilverBullet3-desktop-3.0.0-intl-rc.9-macos-intel.zip42 MB	`a03da539717f3ce703c3b63d5ab572c27850fe89d3ad8ebf33ca51abe93357ab`
Linux — x64glibc 2.31 or later (Ubuntu 20.04+, Debian 11+, RHEL 9+)	SilverBullet3-desktop-3.0.0-intl-rc.9-linux-x64.zip45 MB	`bf2b8be51ce77f1acbb2ef479d1681815e2ab54f97b925f1618b0ce3512b23d0`
Linux — Arm64glibc 2.31 or later	SilverBullet3-desktop-3.0.0-intl-rc.9-linux-arm64.zip42 MB	`8356a42e25d910d8e594675272a46cfdf8b12095a3ea91a457d4d9f6f2f5c0ce`

Checking with Silver Bullet already installed

A Silver Bullet you already trust can check a new package's signature with the release key built into it, after you unzip the package and before you install it:

"/Applications/Silver Bullet 3.app/Contents/MacOS/SilverBullet" verify-package ~/Downloads/SilverBullet3-desktop-<version>-<system>   # macOS
~/.local/opt/silver-bullet-3/SilverBullet verify-package SilverBullet3-desktop-<version>-linux-x64                             # Linux
& "$env:LOCALAPPDATA\Programs\SilverBullet3\SilverBullet.exe" verify-package .\SilverBullet3-desktop-<version>-windows-x64 | Out-Host   # Windows

It says Verified, or why the package was refused (a file changed, added or missing, or another key). Versions before 3.0.0 do not have this command.

What the install command checks

The SHA-256 of every package is written into the install command's script when a release is published. The script comes from this website, the packages from the download server, so a package changed on the download server alone is refused.
When Silver Bullet is already installed, the installed copy checks the new package's signature, as above, before anything is replaced.
On Windows, the installed files keep Windows' mark of a downloaded file, so Windows can warn before the first start.

Reporting a security problem

E-mail [email protected] with what you found and how to reproduce it. Please give us time to fix it before you publish it.