Security
Check what you downloaded, on your own machine.
You should not have to take our word for it. Everything on this page can be checked with tools that already come with macOS and Windows.
Three checks, in the order worth doing them
Does your system accept it?
On a Mac, drag the app into Applications and double-click. If it opens without sending you to System Settings, macOS has already verified Apple's notarization for that exact build. On Windows, right-click the installer, choose Properties, and open Digital Signatures: it must list Oceanic Consulting VOF, and Details must say the signature is OK.
Who signed it?
The team identifier is what matters — anyone can type a name, but Apple issues the team ID. Ours is F94FQUQ5CX.
codesign -dv --verbose=2 /Applications/TOTEMGet.app 2>&1 | grep -E 'Authority|TeamIdentifier'
On Windows, in PowerShell — the status must be Valid and the signer CN=Oceanic Consulting VOF:
Get-AuthenticodeSignature $env:USERPROFILE\Downloads\TOTEMSurf-*-setup.exe | Format-List Status, SignerCertificate
Are these the bytes we published?
Compare the SHA-256 of your download with the one listed on its download page.
shasum -a 256 ~/Downloads/TOTEMGet-*.dmg
On Windows:
Get-FileHash $env:USERPROFILE\Downloads\TOTEMGet-Setup-*.exe
Why an update cannot be faked
Updates are not trusted because they arrive over HTTPS. Each release is signed with a key that never leaves our build machine, and the app carries the matching public key. Anything unsigned, or signed by anyone else, is refused.
- macOS updates
- Ed25519 signature, checked by Sparkle
- Windows updates
- DSA signature, checked by WinSparkle
- Mac installers
- Developer ID + Apple notarization
- Windows installers
- Authenticode, signed by Oceanic Consulting VOF