About PGP Signatures
====================

GPG signatures are a proof that distributed files have been signed by the owner of the signing key. For example, if this website was compromised and the original BitWindow files had been replaced, signature verification would fail, because the attacker would not be able to create valid signatures. (Note that an attacker would be able to create valid hashes, so they would be able to rewrite the list below -- just not the signature verification.)

In order to be able to verify GPG signatures, you need to import the public key of the signer. The binaries below are signed with Paul Sztorc's public key (16C8...). When you import a key, you should always double-check its fingerprint using independent sources, such the MIT PGP keyserver (https://pgp.mit.edu/) or the Web of Trust.

Paul's Key: 16C8 1597 E76E 86E6 C01E F037 AA4B 3330 F162 C410


* * *


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================================================================
BitWindow 3/26/2026 Release

Filename                                             SHA-256
- --------                                             -------
BitWindow-latest-x86_64-apple-darwin.dmg             EC6B0D4EA82F36A070C64E0826401B5D8E762092DFBAD58560C8E6B013D82158
BitWindow-latest-x86_64-apple-darwin.zip             7B0761F215D5782060C95B59D26137C268FED5C19606489090B2E3E9E1BFF91E
BitWindow-latest-x86_64-unknown-linux-gnu.AppImage   9B6037A429D5052F6B414D7DF7156978F8AF253432408F25979B39BB335F5241
BitWindow-latest-x86_64-unknown-linux-gnu.zip        1223E2DFDA305754DB34B4DB13105EAA27934F1106B91CE05AEAD59E2E615C7F
BitWindow-latest-x86_64-windows.exe                  E168BC8B5465030EC8AD30AE0B0208BF64D8781ABCFD03DE3523D5639F796FB5
=====================================================================================================================
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEFsgVl+duhubAHvA3qkszMPFixBAFAmnE4msACgkQqkszMPFi
xBCh5Qf/eoMxTlvM28f0PDWvJsgvkwu8dIcYecoFEA7JA8vkAZTts5pjxe2gcLw1
SKhBkLofD0AM/xQ5EzhA/C6s5r/l5j3jsLBHm8eHCeyBX8+gIYkiGKCZy9UNYD/e
DZRiqHnajzph8nKmfA6YKMoRJ7Bt+/KtiRxPhmwgzcQbw9h0cmR95tBbb1e4guqY
LGUAfZZbiezFlyZHm67rr2+RrxEJC/FeI3w+87R9QOJycNmbBUvSutJQ/awIjSD9
kHW1ARueD3ZClCN6v5j3jFxMkKcjjLhKpA8yBoq3d5GV6+TGY9aWJGpFHcTqK58T
VJLhsBhAocV7YVa+hCcw4D6BBIAb2w==
=K1k/
-----END PGP SIGNATURE-----