Local-First Desktop App

Get Jelby for Desktop

Select the native installer for your operating system. All builds are cryptographically signed, timestamped, and attested.

Download for Windows (x64)

v0.0.1 • 100% Free & Local

All Available Installers & Artifacts

Signed, notarized & attested builds — streamed from your account

Windows (x64).exe (NSIS)

Jelby_x64-setup.exe

Authenticode Signed (Azure Artifact Signing)

Pending

macOS (Apple Silicon).dmg (aarch64)

Jelby_aarch64.dmg

Developer-ID Signed, Notarized & Stapled

Pending

Provenance & Integrity Bundles

Publisher Trust & Security Notes

What to expect during download and first run

Windows (SmartScreen Notice)

As a newly published desktop application, our new Authenticode publisher certificate is in the process of accumulating Microsoft SmartScreen reputation. During the initial release window, Windows may display a standard "Windows protected your PC" dialog upon launch.

Verify Publisher: Right-click the .exe, select Properties → Digital Signatures to confirm it is signed by Wilburn Pacific Company with an RFC-3161 timestamp.

To Run: Click "More info", then select "Run anyway".

macOS (Apple Silicon)

The macOS installer (.dmg) is fully Developer-ID code-signed, notarized by Apple Ticket Service, and stapled.

Zero Warning: Opens cleanly on standard double-click without Gatekeeper bypass prompts or secondary overrides.

Architecture: Optimized natively for Apple Silicon (M1/M2/M3/M4) aarch64 processors.

Cryptographic Supply Chain Integrity

How to Verify Jelby Builds

Every official Jelby release includes cryptographic build provenance (SLSA) and SHA-256 checksums. You can independently verify that your downloaded binary has not been tampered with and was compiled directly from our audited source repository.

Recommended (Strongest)

1. Verify SLSA Build Provenance (Air-Gapped / Offline)

Every Jelby binary is attested with cryptographic SLSA provenance during the GitHub Actions build pipeline. You can verify that the binary was built unmodified from our audited source code.

Windows Installer Verification

gh attestation verify Jelby_x64-setup.exe --bundle release-attestation.json --custom-trusted-root trusted_root.jsonl --repo wilburn-pacific-company/jelby

macOS Installer Verification

gh attestation verify Jelby_aarch64.dmg --bundle release-attestation.json --custom-trusted-root trusted_root.jsonl --repo wilburn-pacific-company/jelby

Why is --repo wilburn-pacific-company/jelby specified?

While release binaries are distributed publicly from jelby-releases, the cryptographic SLSA attestation identifies the private core product repository wilburn-pacific-company/jelby as the authentic build source.

Because Jelby is built within GitHub Enterprise, verification uses the pinned Sigstore trusted root (trusted_root.jsonl) included in each release, enabling 100% offline, reproducible verification without requiring third-party API tokens.

2. Verify SHA-256 Checksums

Verify the integrity of downloaded binaries against our published checksums.

Jelby_x64-setup.exe

Available upon release publication

Jelby_aarch64.dmg

Available upon release publication

Automated Checksum Command:

sha256sum -c SHA256SUMS.txt

Step-by-Step Verification Guide

Follow these commands in your terminal to perform independent validation

1Download Release Assets & Companion Files

In addition to your platform installer (.exe or .dmg), download the companion provenance files from the release:

release-attestation.json

SLSA bundle

trusted_root.jsonl

Sigstore trust root

SHA256SUMS.txt

Plaintext hashes

2Run the GitHub CLI Attestation Verifier

Ensure you have the GitHub CLI (gh) installed (v2.49.0+), then run the offline verification command in the directory containing your downloaded files:

gh attestation verify <installer-file> --bundle release-attestation.json --custom-trusted-root trusted_root.jsonl --repo wilburn-pacific-company/jelby

A successful verification output displays "Loaded digest … from attestation" and confirms the build was generated by the official CI provenance workflow in wilburn-pacific-company/jelby.

3Alternative: Checksum Validation

If you prefer a fast integrity check against accidental download corruption, compare the SHA-256 hash:

sha256sum -c SHA256SUMS.txt