Is Trackhop safe?

Every file of every release, the Android app and Trackhop Desktop, is checked on VirusTotal as soon as it is published: the antivirus engines VirusTotal runs look at it, and the results are linked below and in the release’s notes on GitHub.

The SHA-256 next to each file is its fingerprint: the file you downloaded is the one checked when its own SHA-256 is the same (on Windows certutil -hashfile <file> SHA256, on macOS and Linux shasum -a 256 <file>).

How Trackhop is built

• Open source. All the code is on GitHub, under the GPL-3.0.
• Built in public. Every file of a release is built by GitHub Actions from the code of that release’s commit, and the build logs are public. Nothing is built on a personal computer.
• F-Droid builds it again. F-Droid compiles the Android app from the source on its own servers and checks that the result matches the published APK, byte for byte.
• The Android app’s signature, the same on GitHub, F-Droid and Obtainium (SHA-256 of the signing certificate): 21:EA:DF:26:8C:72:F8:55:65:96:1A:60:45:BF:4B:E5:AB:AF:25:6D:68:0D:1E:0D:80:8D:93:ED:22:D3:50:32. Android refuses an update signed with any other key.

Why Windows or macOS may still warn you

Trackhop Desktop is not signed with a paid Microsoft or Apple certificate yet, so Windows SmartScreen may say it does not know the publisher, and macOS asks you to open it from Privacy & Security the first time (how). That is about who signed the file, not about what is inside it: the VirusTotal results above are about what is inside. Now and then a single engine flags an unsigned installer with a generic “unknown program” verdict; the report shows which engine and why, and the badge then says “checked” instead of “clean”.

All guide pages