Rhizome

Different apps. One ecosystem. Owned by none.

Start here

Two things happen on this page. You get the files — each app is one file, and saving it is the whole install. And you check that the copy you got is the copy that was published, however many hands it passed through on the way.

Nothing here has been released yet. At the first release, the hash for each file below gets copied in from the signed SHA256SUMS file, and this notice comes out. Until then, every slot says so plainly. This page will never show you a made-up hash.

The files

Each app is one file. Save it, open it in a browser, and that's the whole install. The same file works wherever it came from — this page, an email, or a memory stick. The SHA-256 column is the fingerprint each file will carry once released.

What's here, and the fingerprint each file will carry once released.
FileWhat it isSHA-256
vouch.html Vouch. You’re you. Friends can help you back in if you lose your phone. Not released yet.
vote.html Vote. Talk it through, then decide together. Not released yet.
federate.html Federate. Work with the group next door, on terms you both agreed. Not released yet.
tally.html Tally. Keep track of what you owe each other. You both sign it. Not released yet.
clear.html Clear. Everybody owes everybody. This sorts it out in one go. Not released yet.
share.html Share. Borrow the drill. Bring it back. Not released yet.
tend.html Tend. Somebody has to speak for the river. Not released yet.
resolve.html Resolve. Something’s gone wrong. Let’s sort it out properly. Not released yet.
witness.html Witness. Don't take our word for it. Check. Not released yet.
inspector.html Inspector. Opens a record and shows you what's in it, event by event. Becoming part of Witness. Not released yet.
SHA256SUMS The full list — every served file and its hash, one line each. From the first release, the maintainers' signature sits beside it. This is the list itself; the signature is what you check it against.

Each app page has a small helper file beside it (clear.sw.js and so on) that lets the page keep working with no connection once you've visited it. SHA256SUMS lists those too.

If a page here ever looks broken or out of date, the stored copy in your browser is probably stale. Visiting the page again usually clears it by itself; if not, open the clearing page — it removes the stored page copies and touches nothing else — or reload with the Shift key held.

Check the file you got

A hash is a fingerprint worked out from a file's exact bytes. If the fingerprint of your copy matches the one printed here, your copy is exactly what was published — however many hands it passed through on the way. It takes about five minutes the first time and about one after that.

  1. Save the file to your computer

    Right-click a file's name in the table above and choose Save link as, or open it and choose Save page from the browser's menu. Save it somewhere you can find again — your Downloads folder is fine. Note the exact file name; in the steps below we use clear.html, so swap in yours.

  2. Open the tool your computer already has

    Nothing to install. Each system has a built-in way of working out a fingerprint; open the one for yours.

    On Windows

    Open the Downloads folder in File Explorer, click in the address bar at the top, type powershell and press Enter. A window opens, already in that folder. Then type:

    Get-FileHash clear.html
    On a Mac

    Open Terminal (it's in Applications, under Utilities — or press Command and Space and type its name). Type cd Downloads and press Enter to go to the folder. Then type:

    shasum -a 256 clear.html
    On Linux

    Open a terminal, go to the folder holding the file, and type:

    sha256sum clear.html
    On a phone

    Phones don't come with an easy way to do this. If you can, check the file on a computer first, then move it over. The Android app will come through F-Droid, which does its own checking.

  3. Press Enter and read what comes back

    A line of 64 letters and numbers appears. That's your copy's fingerprint. It's the same every time for the same bytes, on any computer, so there's no luck in it.

  4. Compare it with the one printed here

    Put the two side by side. Check the first four characters and the last four, then, if you can, the whole line. Capital letters or small ones make no difference. Every character the same means your copy is exactly what was published. Even one character different means it isn't.

    Until the first release there is no printed fingerprint to compare against — the table above says so. You can still do the steps on the file you have; the number you get is real, it just has nothing to be checked against yet.

  5. If the two don't match

    Don't use the file. Get a fresh copy by a different route — one of the mirrors below, or a friend's copy — and check again. A mismatch doesn't always mean someone tampered with it; downloads get cut short. But a file that doesn't match is not the one that was published, and that is the only thing this check tells you.

How this is judged

The fingerprint is a SHA-256 hash: a fixed-length number worked out from every byte in the file. Change one byte, anywhere, and the number comes out completely different, and nobody has found two different files that share one. Matching hashes mean matching bytes — that is the whole of the test.

It does not tell you who made the file. That is what the maintainers' signature on SHA256SUMS is for: the signature says the list is theirs, and the list says which bytes are which. Check the signature, then check your file against the list, and the chain is complete. Neither step is done for you here — that's rather the point.

Other ways to get this

This website is a convenience, not the home. The same files will be available from places that don't depend on any one account or domain. None of these is live yet, and each slot below stays honest about that until it is.

Source

Not live yet. The source will live on the project's own Forgejo, with a mirror on Codeberg. The address goes here when it exists; until then there is nowhere to point you.

IPFS

Not live yet. When the files are pinned, the content address (CID) goes here. That kind of address is worked out from the file itself, so it can't point at the wrong bytes.

BitTorrent

Not live yet. The magnet link goes here at the first release, and the maintainers keep seeding it.

F-Droid

Not live yet. The project's own F-Droid repository — its address and its signing key — goes here when the Android app exists.

No internet needed

These files travel fine without this site. Email one to a friend. Put it on a memory stick. The file that arrives is the file that left — the hash is how you know.

One limit worth knowing before you hand them round: a browser only switches on its signing and checking machinery for a page that arrived over HTTPS, or one that's been installed. Opened straight off a stick, some browsers allow that machinery and some don't — and where a browser won't, the page says so in plain words instead of showing pretend values.