From bf59d36d3a00e5a50cdf6f6ef6e19fb6c7f5f2d9 Mon Sep 17 00:00:00 2001
From: Igor Churmeev <ingvarch@gmail.com>
Date: Mon, 9 Nov 2026 22:32:55 +0000
Subject: [PATCH] docs: say how to check a downloaded release

---
 docs/install.md | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/docs/install.md b/docs/install.md
index 8ce1bf4..2c83ec6 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -59,6 +59,39 @@ go install github.com/ingvarch/urga/cmd/urga@latest
 A copy built with `go install` shows its version as `dev` and does not check
 for [newer releases](configuration.md#newer-releases).
 
+## Check a download
+
+Each release page has a file of checksums, `urga_<version>_checksums.txt`,
+for every archive and package. Download it into the folder with your
+download, and run there:
+
+```sh
+# Linux
+sha256sum --check --ignore-missing urga_*_checksums.txt
+# macOS
+shasum -a 256 --check --ignore-missing urga_*_checksums.txt
+```
+
+Each file you downloaded should read `OK`. On Windows, in PowerShell, print
+the hash of the archive and its line in the file, and compare the two:
+
+```powershell
+Get-FileHash urga_*_windows_amd64.zip
+Select-String windows_amd64.zip urga_*_checksums.txt
+```
+
+The check shows that the file is the one the release published, not damaged
+or cut short on the way.
+
+The macOS binary is also signed and notarized by Apple. To see it, run in the
+folder of the unpacked archive:
+
+```sh
+spctl --assess --type open --context context:primary-signature -v ./urga
+```
+
+It prints `accepted` and `source=Notarized Developer ID`.
+
 ## From source
 
 ```sh