Install and verify

PromptDust ships honestly unsigned for now and verifiable from day one. Rather than ask you to trust an installer because an OS vendor blessed it, every release carries what you need to check it yourself: per-file SHA-256 checksums, a consolidated SHA256SUMS, a CycloneDX software bill of materials (SBOM), and cryptographic build-provenance attestations tying each artifact back to the exact GitHub Actions run that produced it.

Code signing (macOS Developer ID plus notarization, Windows Trusted Signing) is tracked separately and wires in when the certificates land. It removes the OS warnings below. It does not change what the tool does, and signing gates nothing: the verifiable path ships on its own.

Download

Grab the artifact for your platform from the latest release.

Platform	Minimum OS	Desktop app	Command line
macOS	12 Monterey (Intel or Apple silicon)	PromptDust_*_universal.dmg	promptdust-macos
Windows	10 21H2 (x64)	PromptDust_*_x64-setup.exe or *.msi	promptdust-windows.exe
Linux	Ubuntu 22.04+ (glibc 2.35+, x64)	*.AppImage or *.deb	promptdust-linux

The desktop app uses the system WebView (WebView2 on Windows, preinstalled on Windows 11 and auto-distributed to current Windows 10; the installer adds it if missing. WebKitGTK on Linux). The command line has no such requirement.

Each binary and installer carries a matching <name>.sha256 sidecar, and the release carries a single SHA256SUMS covering all of them.

Verify before you run

This is optional but recommended. It is also the whole point of shipping unsigned-but-verifiable: you do not have to take anyone’s word for the download.

1. Checksums

Confirm the bytes you downloaded match what the release published.

# One file against its sidecar:
shasum -a 256 -c promptdust-macos.sha256

# Or every binary and installer at once, against the consolidated manifest:
shasum -a 256 -c SHA256SUMS       # macOS and Linux
# sha256sum -c SHA256SUMS         # Linux (coreutils)

2. Build provenance

Every binary and installer carries a SLSA build-provenance attestation. With the GitHub CLI you can confirm an artifact was built by this repository’s release workflow, not re-uploaded or tampered with.

gh attestation verify promptdust-macos --repo promptdust/promptdust

A successful verification prints the workflow and commit the artifact came from.

3. SBOM

The release includes CycloneDX SBOMs (promptdust-*.cdx.json) that enumerate every Rust dependency in the command-line, core, and desktop crates. Feed them to your own SBOM or vulnerability tooling.

Getting past the first-launch warning

Because the builds are not signed yet, macOS Gatekeeper and Windows SmartScreen warn on first launch. The warning means the OS cannot confirm the publisher. It does not mean anything is wrong with the download.

macOS

Double-clicking shows “can’t be opened because Apple cannot check it for malicious software.” Either:

• Right-click (or Control-click) the app, choose Open, then Open in the dialog. macOS remembers the choice for that copy.

• Or clear the quarantine flag after you have verified the checksum:

  xattr -dr com.apple.quarantine /Applications/PromptDust.app
  

Windows

SmartScreen shows “Windows protected your PC.” Click More info, then Run anyway. If you verified the checksum and provenance above, you already know more about this build than SmartScreen does.

Linux

No signing prompt. Make the AppImage executable, or install the .deb.

chmod +x PromptDust_*.AppImage && ./PromptDust_*.AppImage
# or
sudo dpkg -i promptdust_*_amd64.deb

Package managers

Homebrew (brew install promptdust for the command line, brew install --cask promptdust for the desktop app) and winget (winget install PromptDust.PromptDust) reduce this friction further. The manifests are authored but not published yet. They go live with the first release. Until then, use the release artifacts above.

Build from source

The command line builds with a standard Rust toolchain.

cargo run --bin promptdust -- scan     # read-only, from a source checkout

The desktop app is a Tauri v2 project and needs the Tauri command-line tool and the platform WebView dependencies.

cd desktop && cargo tauri dev