Download and update verification
Before installation or update, check source, platform, architecture, version, and channel. A file opening or installing successfully does not prove its origin.
Installation checks
- Start at Get EvoX, selecting OS, architecture, and channel.
- Compare the file with release information. For a browser download, check the installer's publisher and the operating system's signature checks before running it; stop if the publisher is unexpected or a security check fails. After updating, inspect the running version in the application menu > About.
- On failure, retain the error and target version, stop installation, and download the matching file through the official entry.
- If failure persists, use the application menu > Feedback with platform, version, and redacted errors. Do not replace verification keys.
The in-app updater performs the checks described below. Browser downloads are not automatically verified by that updater. To independently verify a downloaded file's SHA-256 and Ed25519 signature, use the trusted release evidence described in signed manifests and release verification. Without those checks, do not describe a browser download as digest- and signature-verified.
For an in-app update, accept the result only after the updater's digest and signature checks pass and the running version and channel match. For a browser installation, record the source, publisher, operating-system checks and running version separately from any independent digest and signature checks. The absence of an error does not prove a check ran. A matching filename cannot overrule failed digest or signature validation.
Identify the download
Start from the official EvoX download entry. Check the selected platform and architecture against the actual file and release information. A forwarded filename is not source evidence. Do not treat a test-channel artifact as a stable update.
What the updater verifies
Desktop computes the downloaded file's SHA-256, compares it with the manifest, and verifies its Ed25519 signature against the release key. Missing or mismatched digests and missing or invalid signatures fail verification.
A digest establishes byte consistency; a signature associates the digest with a release key. Verify both through a trusted source. A successful website build does not validate application artifacts. Release management covers building, signing, and channel promotion.
Handle failure
Stop installation or update. Record version, channel, platform, filename, and redacted error details, then download through the official entry again. Do not disable checks, replace keys, or bypass system warnings. If software from an abnormal source already ran, inspect credentials, files, and network effects through incident handling.