Installer Integrity

Why verify a download

When you download an installer, two things can go wrong between the release server and your disk: the file can be corrupted in transit, or, worse, you can be served a modified file from an unofficial source. A cryptographic hash check catches both. The publisher computes the SHA256 fingerprint of the genuine file and publishes it; you compute the same fingerprint of the file you actually received. If even one byte differs, the fingerprints will not match.

This matters more than usual for Orbittest Studio because the installer is not yet Authenticode-signed, Windows SmartScreen will warn you, and the hash check is your real assurance the file is genuine.

The published hash

SHA256 for the v1.0.0 installer:

183CF4BD94647F58CF64F0A482EA4734120DA559E131C9D1C7E5056E2A00ECD6

Orbittest-Studio-Setup-1.0.0.exe (SHA256)

Hashes are per-release: every new installer version gets a new hash, published in its release notes. Always compare against the hash for the exact version you downloaded.

How to verify on Windows

Get-FileHash .\Orbittest-Studio-Setup-1.0.0.exe -Algorithm SHA256

Run in PowerShell, from the folder containing the download.

The output looks like this:

Algorithm       Hash                                                              Path
---------       ----                                                              ----
SHA256          183CF4BD94647F58CF64F0A482EA4734120DA559E131C9D1C7E5056E2A00ECD6  C:\Downloads\Orbittest-Studio-Setup-1.0.0.exe

Compare the Hash value with the published one, it must match exactly, character for character (letter case does not matter). If it matches, run the installer. If it does not, delete the file and download again from the official releases page; do not run a file that fails verification.

Safe download practice

Download only from the official GitHub releases page linked from orbittest.dev. No mirrors, no bundles, no files forwarded in chat.
Verify the hash before the first run, after the SmartScreen prompt is too late to be useful.
Expect the SmartScreen warning (“Windows protected your PC”); More info → Run anyway is the normal path for unsigned installers whose hash you have verified.
A failed hash is not always an attack, interrupted downloads are common, but the response is the same either way: delete, re-download, re-verify.

Frequently asked questions

Why is the installer not code-signed yet?

Authenticode certificates involve identity-verified issuance and yearly cost; signing is on the roadmap. Until then the published SHA256 provides the integrity guarantee, which is exactly what the signature would automate.

Is SHA256 actually trustworthy?

Yes. SHA-256 is the industry-standard cryptographic hash; producing a different file with the same hash is not computationally feasible. It is the same mechanism most Linux distributions use to protect their ISOs.

Can I verify on macOS or Linux before transferring the file?

Yes: shasum -a 256 file.exe (macOS) or sha256sum file.exe (Linux) produce the same fingerprint.

Installation — Install Orbittest Studio on Windows, enable USB debugging on Android, and deploy the Companion app, step by step.
What is Studio? — Orbittest Studio explained: a Windows desktop IDE that puts device mirror, inspector, logcat, editor, and test runner in one app.
Troubleshooting — Fixes for unauthorized devices, missing devices, blocked Companion installs, black mirror screens, and empty log panels.
Contributing — How to propose changes, write bug reports that get fixed, follow the code standards, and report security issues privately.