Official builds are distributed through the Locoris download page and linked GitHub releases.
macOS
Locoris currently supports Apple Silicon Macs. Open the DMG, drag Locoris to Applications and try to launch it once. The application bundle is ad-hoc signed, but it is not yet notarized with a paid Apple Developer ID.
After verifying SHA-256, open System Settings → Privacy & Security. In Sécurité, find the blocked Locoris message, choose Open Anyway, and confirm Open. Do not disable Gatekeeper globally or remove quarantine attributes from an unverified download. Managed computers can disable this override; use Locoris Web or contact the administrator.
Windows
Use the EXE installer for the normal path or the MSI for managed installation. The current installer is not Authenticode-signed. Verify the complete checksum, then choose More info → Run anyway in SmartScreen. Never disable SmartScreen system-wide. Organization policy can remove the override; use Locoris Web or contact the administrator.
Android
Download the signed APK from the official page. Android will ask for permission to install from the browser or file manager. The release publishes both the APK checksum and the stable Locoris signing-certificate fingerprint. Remove the temporary install permission afterwards and do not install repackaged builds from third-party mirrors.
Verify the release
On macOS or Linux, run shasum -a 256 <file>. On Windows, run Get-FileHash <file> -Algorithm SHA256. Compare the complete value with the official download card or SHA256SUMS.txt on hardened releases.
For releases that include GitHub attestations, run gh attestation verify <file> --repo locoris/locoris. A valid result binds the artifact to the official protected Locoris workflow. Checksums alone detect changes; the attestation also identifies the build origin.
Updates
Desktop and Android builds use platform-specific update metadata from one atomic release. The release remains hidden until every required platform, checksum, SBOM, metadata, and attestation check succeeds. If an update fails, keep the current app installed and use the official release page rather than an unknown mirror.