Verify a Cosmonic Desktop download

Every Cosmonic Desktop release is signed so you can confirm a download came from Cosmonic and wasn't tampered with in transit. This guide walks through verifying a download on each platform, step by step.

You do not need to be on the same OS as the artifact you're checking. The Windows section shows how to verify an .exe from macOS or Linux too.

What's signed, and how

Platform	Artifacts	Signature type
macOS	.pkg, .dmg, .zip	Developer ID signature + Apple notarization, stapled
Windows	.exe installer	Authenticode (Microsoft-rooted, timestamped)
Linux	.deb, .rpm, .AppImage, .tar.gz	Detached GPG signature (.asc next to each download)

The identities to expect:

• macOS: Developer ID Application: Cosmonic Corp. (P58A46SSGS) (apps) and Developer ID Installer: Cosmonic Corp. (P58A46SSGS) (.pkg)
• Windows: CN=Cosmonic Corp, O=Cosmonic Corp, L=Arlington, ST=Virginia, C=US
• Linux GPG key: Cosmonic Desktop <security@cosmonic.com>, fingerprint:

EA59 5920 7529 956B A96E  B46C E4BD 54CF 6605 36AD

macOS

Release builds are Developer ID-signed and notarized, so Gatekeeper opens them without warnings; a warning at first launch is itself a red flag.

To check explicitly, on the installed app:

codesign --verify --deep --strict /Applications/Cosmonic\ Desktop.app
spctl --assess -vv /Applications/Cosmonic\ Desktop.app
xcrun stapler validate /Applications/Cosmonic\ Desktop.app

A good result: codesign exits silently, spctl reports source=Notarized Developer ID with origin=Developer ID Application: Cosmonic Corp. (P58A46SSGS), and stapler reports The validate action worked!.

For a .pkg installer, before running it:

pkgutil --check-signature ~/Downloads/cosmonic-desktop-*.pkg

Expect Status: signed by a developer certificate issued by Apple and Developer ID Installer: Cosmonic Corp. (P58A46SSGS) in the chain.

Windows

The installer is Authenticode-signed with a certificate that chains to a Microsoft root and carries a trusted timestamp.

On Windows

GUI: right-click the .exe → Properties → Digital Signatures. You should see a signature from Cosmonic Corp. Select it → Details → View Certificate to inspect the chain and timestamp.

PowerShell:

Get-AuthenticodeSignature .\cosmonic-desktop-*.exe | Format-List

A good result shows Status : Valid and a signer of CN=Cosmonic Corp. Anything else (HashMismatch, NotSigned) means don't run it.

On macOS or Linux

Non-Windows systems have no Authenticode support built in, so install osslsigncode and supply the Microsoft root yourself.

# macOS                          # Debian/Ubuntu                        # Fedora/RHEL
brew install osslsigncode        # sudo apt-get install osslsigncode    # sudo dnf install osslsigncode

Public CA bundles do not include the root that Microsoft Trusted Signing chains to, so fetch Microsoft Identity Verification Root Certificate Authority 2020 from Microsoft and convert it to PEM:

curl -fsSL -o ms-root.crt \
  "https://www.microsoft.com/pkiops/certs/Microsoft%20Identity%20Verification%20Root%20Certificate%20Authority%202020.crt"
openssl x509 -inform DER -in ms-root.crt -out ms-root.pem

Then verify:

osslsigncode verify -CAfile ms-root.pem cosmonic-desktop-<version>-x64.exe

Look for Signature verification: ok and a signer of Cosmonic Corp. (If you skip -CAfile, self-signed certificate in chain is expected; that's the missing Microsoft root, not a bad signature.)

Linux

Every Linux package is published with a detached GPG signature: the same URL as your download, with .asc appended. The signing public key (cosmonic-signing-public.asc) is published alongside your download links.

Step 1. Download the artifact, its .asc, and the public key:

curl -fLO <your-download-url>/cosmonic-desktop-<version>-amd64.deb
curl -fLO <your-download-url>/cosmonic-desktop-<version>-amd64.deb.asc
curl -fLO <your-download-url>/cosmonic-signing-public.asc

Step 2. Import the public key:

gpg --import cosmonic-signing-public.asc

Step 3 (recommended). Confirm the fingerprint matches the one published at the top of this page before trusting it:

gpg --fingerprint security@cosmonic.com
# Expect: EA59 5920 7529 956B A96E  B46C E4BD 54CF 6605 36AD

Step 4. Verify:

gpg --verify cosmonic-desktop-<version>-amd64.deb.asc cosmonic-desktop-<version>-amd64.deb

A good result reads Good signature from "Cosmonic Desktop <security@cosmonic.com>". The same commands work for .rpm, .AppImage, and .tar.gz; point at the matching .asc.

note

GPG will also print WARNING: This key is not certified with a trusted signature unless you locally sign the key. That warning is about your local trust database, not the signature's validity. Good signature plus a matching fingerprint (Step 3) is the verification. To silence it: gpg --lsign-key EA5959207529956BA96EB46CE4BD54CF660536AD

Troubleshooting

Symptom	Meaning / fix
Gatekeeper warns on first open (macOS)	Release builds are notarized and should open cleanly; treat the download as suspect and re-download from your invitation links.
self-signed certificate in chain (osslsigncode)	You didn't pass the Microsoft root; add -CAfile ms-root.pem.
Status : NotSigned / HashMismatch (PowerShell)	The file is unsigned or altered. Don't run it; re-download.
GPG Can't check signature: No public key	Import the key first (Linux Step 2).
GPG not certified with a trusted signature	Informational; confirm the fingerprint instead (Linux Step 3).

If a signature genuinely fails to verify on an official download, don't run the binary; email security@cosmonic.com.