Before installing any desktop app, confirm that the file you downloaded is the file we published. Dingdok ships a SHA-256 hash and a code signature so you can check both.
Why verify
- Detects a truncated or corrupted download.
- Detects a file swapped by a malicious mirror or proxy.
- Confirms the installer was signed by Dingdok.
Method 1 — Compare the SHA-256 hash
Every download page lists the expected hash. Compute the hash of your file and compare.
Windows (PowerShell or Command Prompt):
certutil -hashfile Dingdok-Setup-5.3.0-x64.exe SHA256
macOS / Linux:
shasum -a 256 Dingdok-5.3.0.dmg
The output must match the published value exactly, character for character. A single difference means the file is not trustworthy — delete it and download again from the official page.
Method 2 — Check the code signature
Windows:
- Right-click the installer and choose Properties.
- Open the Digital Signatures tab.
- Confirm the signer is Dingdok and the signature is valid.
macOS:
codesign --verify --deep --strict --verbose=2 /Applications/Dingdok.app
spctl --assess --type execute --verbose /Applications/Dingdok.app
A notarized build reports “accepted” from spctl.
If verification fails
- Do not run the file.
- Re-download from the official Download page and retry.
- If it still fails, report the hash you got so we can investigate a mirror problem.
Tips
- Verify on the same machine you will install on, immediately after downloading.
- Keep the hash list for the version you use, in case you need to check a copy later.
- Prefer the official Download page over third-party software portals.
Related
See “Install Dingdok on Windows” or “Install Dingdok on macOS” for the next step.