INSTALL

Verify installer

Check that your download or installed application was signed by InFlow and has not been altered. The hosted installers verify downloads automatically; the commands below let you check them yourself.

Choose the command that matches how you installed InFlow. It sets the application path for the checks that follow. If you chose a custom installation folder, use that path instead.

Hosted installer
application="$HOME/.local/share/inflow/InFlow.app"
Homebrew
application="$(find "$(brew --caskroom inflow)" -maxdepth 2 -name InFlow.app -type d -print -quit)"

Next, check the application's signature and Apple's Gatekeeper assessment. Do not run the application if either check fails.

codesign --verify --deep --strict --verbose=2 "$application"
spctl --assess --type execute --verbose=2 "$application"
EXPECTED OUTPUT
InFlow.app: valid on disk
InFlow.app: accepted
source=Notarized Developer ID

Check the signing identity too. InFlow's Apple developer team identifier is B96U57DTR2; the command below must report that value.

codesign -dv --verbose=4 "$application" 2>&1 | grep TeamIdentifier
EXPECTED OUTPUT
TeamIdentifier=B96U57DTR2

Run this command in PowerShell to check the installed application's digital signature. The status must be Valid and the certificate must identify Jarwin, Inc., as shown below.

Get-AuthenticodeSignature (Get-Command inflow).Source |
  Select-Object Status, @{Name='Subject'; Expression={$_.SignerCertificate.Subject}} |
  Format-List
EXPECTED OUTPUT
Status  : Valid
Subject : CN="Jarwin, Inc.", O="Jarwin, Inc.", L=Gilroy, S=California, C=US
If verification fails

NotSigned or HashMismatch indicates a missing signature or altered file. Do not run the application if the status is not Valid or the publisher does not match.

On Linux, verify the package before installing it. InFlow signs a list of file checksums with its release signing key. The commands below verify that signature and compare your downloaded package with the signed checksum.

From the GITHUB RELEASE for your version, download your .deb or .rpm package, SHA256SUMS, SHA256SUMS.asc, and inflow-linux-signing-key.asc into one folder. Open a terminal in that folder. You will need GnuPG and sha256sum to run the checks.

test "$(gpg --batch --with-colons --show-keys inflow-linux-signing-key.asc | awk -F: '$1 == "fpr" { print toupper($10); exit }')" = "508C278E08BED465D79E20F71D0FCE31F33234BA" &&
gpg --batch --yes --dearmor --output inflow-linux-signing-key.gpg inflow-linux-signing-key.asc &&
gpgv --keyring ./inflow-linux-signing-key.gpg SHA256SUMS.asc SHA256SUMS &&
sha256sum --check --ignore-missing SHA256SUMS
EXPECTED OUTPUT
gpgv: Good signature from "InFlow Release Signing"
inflow_0.12.0_amd64.deb: OK

The signing key's fingerprint must be 508C278E08BED465D79E20F71D0FCE31F33234BA.

Signature and checksum checks

The commands first check that you have the expected signing key. Good signature confirms that the checksum list was signed with that key. Your downloaded package must also report OK; its filename will depend on your version and platform. If the commands stop before that result, do not install the package.

If the checksum does not match

inflow_0.12.0_amd64.deb: FAILED followed by sha256sum: WARNING: 1 computed checksum did NOT match means the package does not match the signed checksum. Do not install it. Download the package again from the same release and repeat the checks. Report the problem if it still fails.

Where your credentials are stored

InFlow stores your credentials in an encrypted vault on your computer. On Linux, the installer also sets up the system services that manage access to the vault. Those services require systemd.