Checking download containers for consistency

All Noto releases consist of a signed DMG container. You can check the signature of a signed DMG by running the command below in the terminal:

$ codesign --verify --verbose ~/Downloads/noto-1.0.dmg

If the DMG file is signed correctly, you should see the output below:

> noto-1.0.dmg: valid on disk
> noto-1.0.dmg: satisfies its Designated Requirement

If the DMG is not signed properly, you will see a different output depending on the problem. For example, if the DMG has no signature:

> noto-1.0.dmg: code object is not signed at all

You can also check the SHA256 signature of the DMG by running the command below in the terminal:

$ shasum -a 256 ~/Downloads/noto-1.0.dmg
> 55f95e113e45c6881fc7a743e91f0e4fa1556e3d251958d9a1043ecfb77c33af  noto-1.0.dmg

You can find the correct SHA256 for the specific release container you wish to verify in the list below:

All previous releases