+++
title = "Release Hashes"
description = "Verify you are using genuine After Dark software."
categories = ["security"]
tags = ["validate", "privacy", "security", "cryptography", "npm", "git"]
features = ["code highlighter", "related content"]
[[copyright]]
  owner = "Josh Habdas"
  date = "2019"
  license = "agpl-3.0-or-later"
+++

After Dark utilizes the {{< external href="https://www.npmjs.com" text="NPM" />}} CLI to produce a unique cryptographic hash each release, enabling any copy to be uniquely identified regardless of its source.

Release hashes use the <abbr title="Secure Hashing Algorithm">SHA-512</abbr> algorithm and look like this:

{{< hackcss-alert type="success" >}}
<samp>VWcn7AxXUkZRGsRIM/6A5RjqW7DOPH+XbnLGRp7hpr0TCH/9l31ug2h2JaIlEvsDzOPRcZDBdyZvJ4mSm/Rqjg==</samp>
{{< /hackcss-alert >}}


Each release a new hash is generated in the following locations:

- Embedded using PGP in the {{< external href="https://git.habd.as/comfusion/after-dark/releases" text="release source" />}} `git tag` message.
- Codified into the {{< external href="https://registry.npmjs.org/after-dark/latest" text="latest" />}} or {{< external href="https://registry.npmjs.org/after-dark/6.7.9" text="version-specific" />}} NPM package metadata.
- Embedded inside the After Dark [Online Help](../online-help) documentation.

Upon receiving your copy of After Dark you may use the release hash to verify you are using an unadulterated version of the software.

Run the [Release Validator](/validate) to quickly check your release offline:

{{< hackcss-card header="Interactive Release Validator" >}}
<iframe title="Validate Release" scrolling="no" width="100%" height="360" src="/validate"></iframe>
{{< /hackcss-card >}}

For a more thorough inspection do the following:

1. Install the {{< external href="https://docs.npmjs.com/cli/npm" text="npm cli" />}} on your machine.
2. Navigate to `themes/after-dark` from within your site.
3. Run `npm i && npm run integrity` to generate your SHA-512 hash.
4. Compare your hash to the hash generated during a signed release.
5. If equal, verify the GPG signature used to sign that release.

If inspection fails run the [Upgrade Script](../upgrade-script/) and try again.