Nothing runs before it is verified
Every package is checked against the feed and your key before the installer starts. The signed manifest must also name your project, the version and the platform, so a feed cannot hand out a relabelled package.
- Size matches the feed
- SHA-512 hash matches
- RSA-PSS signature, PEM key
- Manifest names project, version, platform