Skip to content
Sval
Download

Check a download

Each Sval release publishes SHA256SUMS, a list of every file’s SHA-256 checksum. Ellm Tree signs the list with Sval’s release key. When your file’s checksum is on a list with a good signature, your file is the one Ellm Tree published, and nothing changed on the way to you.

You got Sval from a link someone sent you, and you want to be sure the file came from Ellm Tree before you install it.

Check the file’s checksum on macOS or Linux

Section titled “Check the file’s checksum on macOS or Linux”
  1. On the Download page, under Verify your download, download SHA256SUMS into the folder with your Sval file.
  2. Open Terminal, and go to that folder.
  3. On macOS, run shasum -a 256 -c --ignore-missing SHA256SUMS. On Linux, run sha256sum -c --ignore-missing SHA256SUMS.

The command prints your file’s name and OK. Any other answer means the file is damaged or isn’t Sval’s, so delete it and download Sval again.

Check the file’s checksum on Windows

Section titled “Check the file’s checksum on Windows”
  1. On the Download page, under Verify your download, download SHA256SUMS into the folder with your Sval file.
  2. Open PowerShell, and go to that folder.
  3. Run Select-String -Path SHA256SUMS -Pattern (Get-FileHash sval-*.exe).Hash. If you downloaded the .zip, type .zip in place of .exe.

PowerShell prints the line of SHA256SUMS that names your file. When it prints nothing, the file is damaged or isn’t Sval’s, so delete it and download Sval again.

Check the list’s signature

Section titled “Check the list’s signature”

This step needs GnuPG. Linux usually has it. On a Mac, install GPG Suite, and on Windows, Gpg4win.

  1. On the Download page, under Verify your download, download SHA256SUMS, SHA256SUMS.asc, and sval-archive-keyring.asc into one folder.
  2. In a terminal in that folder, run gpg --import sval-archive-keyring.asc.
  3. Run gpg --verify SHA256SUMS.asc SHA256SUMS.

GnuPG says Good signature, and its last line is the key’s fingerprint: 294F 1F37 83E6 A345 616D F757 007B AE81 50D9 8CEE. Some versions of GnuPG print the fingerprint without the spaces.

Details

Section titled “Details”
  • GnuPG also warns that the key isn’t certified with a trusted signature. That warning means you haven’t marked the key as trusted yourself. The fingerprint matching is what counts.
  • Sval for macOS is also signed with Ellm Tree’s Apple Developer ID and notarized by Apple, which macOS checks when you open Sval.
  • The .deb and .rpm packages that apt and dnf install are checked against the same release key every time they update.

If something goes wrong

Section titled “If something goes wrong”
  • The command says FAILED, or BAD signature. Delete the files, and download them again from the Download page.
  • The fingerprint is different. Don’t install that file. Download Sval from the Download page on sval.app.
Section titled “Related pages”

© 2026 Ellm Tree, Inc. Sval is not officially associated with Mozilla or its products. Firefox is a trademark of the Mozilla Foundation in the US and other countries.