Every release of Wi-Fi2QR ships a signed checksum manifest and a build-provenance statement, so you can confirm that the binary you downloaded is the exact artifact this project's CI built from a specific, public git commit.

Each release (on the releases page) carries these files alongside the app downloads:

RWSkY/1m7/T4kf6WOuu3z80TCFO962ckT7af0cuenWGkNMlcRIS4fj1L

This key is published here in the repository (minisign.pub), at https://wifi2qr.app/minisign.pub, and in every release. It never changes. If you've trusted it once, pin it — a mismatch on a later release means something is wrong.

# 1. Signature over the checksum manifest is valid & from our key:
minisign -Vm SHA256SUMS -P RWSkY/1m7/T4kf6WOuu3z80TCFO962ckT7af0cuenWGkNMlcRIS4fj1L
#    -> "Signature and comment signature verified"
#    -> "Trusted comment: wifi2qr <tag> commit <sha>"   <- the source commit it was built from

# 2. Your downloaded file matches the manifest:
sha256sum -c SHA256SUMS            # Linux
shasum -a 256 -c SHA256SUMS        # macOS
#    -> "<file>: OK"

# 3. (optional) verify + read the provenance statement:
minisign -Vm provenance.json -P RWSkY/1m7/T4kf6WOuu3z80TCFO962ckT7af0cuenWGkNMlcRIS4fj1L
cat provenance.json                # subject digests, git commit, CI run URL

You can then open that commit on the source and read exactly what it built from.

Proves: the artifact you have is byte-for-byte the one this project's CI produced, and it records the precise git commit + CI run it came from. Tampering after the build — or a file swapped on a mirror — fails verification.

Doesn't prove (yet): that the CI itself faithfully built that commit. That final step requires reproducible builds — anyone rebuilding the commit and getting identical bytes. We don't claim bit-for-bit reproducibility for the desktop binaries: the Tauri/Rust and SwiftUI toolchains embed non-deterministic data, and platform code-signing (Apple Developer ID, the Microsoft Store MSIX) deliberately does too. This is a known limitation of all signed native apps, not specific to Wi-Fi2QR.

The web app is the easy case. https://wifi2qr.app is just the static files under web/ plus the generated i18n.js (run python3 i18n/bundle.py). There's no opaque build step — you can diff the served files against the source directly.

Note this is separate from the platform identity signing already in place (macOS builds are Apple Developer ID–signed + notarized; the Windows build is a signed Store MSIX). That proves "from mineracks, untampered"; the provenance above adds "and here's the source it came from."

Please report security issues privately to info@mineracks.com rather than opening a public issue. Wi-Fi2QR runs entirely on-device and never transmits the Wi-Fi password (it is only encoded into the QR image), so the main surface is the app binaries and this build chain.