autobot / autobot.sh

Autobot · download verification

Verify a download

A matching hash proves the file is the one the release published. A matching certificate proves it was signed by the same key as earlier builds.

Latest v1.10.0 · 19 OCT 2026 · install notes

1. Check the APK hash

Download the APK and SHA256SUMS.txt from the same release. Compare the full line, not a prefix.

shasum -a 256 autobot-1.10.0-release.apk

# expected
a5446a867ab1ddedc074b424fb237e621ac87671004a07b398924c9811e04766
SHA256SUMS.txt Release v1.10.0 ↗

On Windows: certutil -hashfile autobot-1.10.0-release.apk SHA256

2. Check the signer

apksigner comes with the Android SDK build-tools.

apksigner verify --print-certs autobot-1.10.0-release.apk

# Signer #1 certificate SHA-256 digest:
# 9a1378acf9587885e7920355558c85a1ec0e89304f58c153feebf90fdee7f3f1
ItemValue
Certificateautobot-release-2026
SHA-2569a1378acf9587885e7920355558c85a1ec0e89304f58c153feebf90fdee7f3f1
App IDai.wckd.autobot

3. Check the agent’s install script

This site serves a verbatim mirror of Invincible’s installer. Its SHA-256 is recorded when the site is built. The script checks a signed SHA256SUMS against the release key pinned inside it, and checks the Sigstore attestation when the GitHub CLI is signed in.

# mirror served at
https://invincible.sh/install.sh

# SHA-256
5d4b762f27e9f4052824e91fbc0f8cf1fad82d10706264a32fd66d6ad4ba8352

# size · fetched
15828 bytes · 19 OCT 2026

Upstream install.sh ↗ · Manual release verification ↗

What verification proves

A matching hash proves the file is the one the release published. A matching certificate proves the APK came from the same signing key as earlier Autobot builds. Neither proves the code is free of bugs; both make a swapped or tampered download visible.

Versions move together: Android and iOS ship the same version and build number. If the release notes and the certificate disagree with the file, stop and use the repository’s copy.

What it does not prove

Privacy model Source