Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4262GitHub issuePublicReceived

SHA256 checksum mismatch for omarchy-3.5.0.iso

Reported by rjltrevisan · filed Apr 5, 2026Closed upstream on 2026-04-06 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

SHA256 checksum mismatch for omarchy-3.5.0.isorevision 1 · captured 2026-10-04 11:49 UTC via poll

SHA256 checksum mismatch for omarchy-3.5.0.iso

The SHA256 hash listed on the v3.5.0 release page does not match the file currently served at https://iso.omarchy.org/omarchy-3.5.0.iso.

Expected (from release notes)

0d3a7944240df631c5c9f7802d735a96bb0a6a3f8a65b7d45b609699aa888bd5

Actual (downloaded file)

42be4b5b30bcb43de1b942741a093f5013e37a408f122f9060f01619a1545a2d

Steps to reproduce

curl -fsSL https://iso.omarchy.org/omarchy-3.5.0.iso -o omarchy-3.5.0.iso
sha256sum omarchy-3.5.0.iso

The download was performed twice independently and produced the same hash both times, so this is not a network/corruption issue — the file on the server appears to have been replaced after the release was published.

This is a security concern as users cannot verify the integrity of the downloaded ISO against the published checksum.

View raw text
## SHA256 checksum mismatch for omarchy-3.5.0.iso

The SHA256 hash listed on the [v3.5.0 release page](https://github.com/basecamp/omarchy/releases/tag/v3.5.0) does not match the file currently served at https://iso.omarchy.org/omarchy-3.5.0.iso.

### Expected (from release notes)
```
0d3a7944240df631c5c9f7802d735a96bb0a6a3f8a65b7d45b609699aa888bd5
```

### Actual (downloaded file)
```
42be4b5b30bcb43de1b942741a093f5013e37a408f122f9060f01619a1545a2d
```

### Steps to reproduce
```bash
curl -fsSL https://iso.omarchy.org/omarchy-3.5.0.iso -o omarchy-3.5.0.iso
sha256sum omarchy-3.5.0.iso
```

The download was performed twice independently and produced the same hash both times, so this is not a network/corruption issue — the file on the server appears to have been replaced after the release was published.

This is a security concern as users cannot verify the integrity of the downloaded ISO against the published checksum.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.