Where Kyro comes from
Kyro is published only on GitHub Releases. The links on our download page point there. There is no mobile app, so anything in an app store using the name is not ours.
The easy way
The one-line install does this check for you. It compares the SHA-256 of the file with SHA256SUMS, and stops if they differ. Read the scripts first if you like: install.ps1 and install.sh.
By hand
- Download your installer and SHA256SUMS into the same folder.
- Run the command for your system.
- Compare the result with the line for your file in SHA256SUMS. Every character must match.
If the hashes differ
Delete the file and download it again from GitHub Releases. Do not run it.
What this proves, and what it does not
A match proves your file is the one listed in that release, with no corruption and no swap along the way. It does not prove the code is free of bugs, and it depends on the release itself being genuine.
Two more honest limits. The installers are not code-signed yet, so your system warns on first launch: check the hash before you click through. Bit-for-bit reproducible builds are a goal, not a guarantee yet. If you want more certainty, build Kyro from source.
After the first install
Updates verify themselves. Each one is signed, and Kyro checks the signature against a public key built into the app before installing. A bad signature is rejected.