# Verifying JAR File after Installation – SIGNATURE MISTMACH

**URL:** <https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795>\
**Category:** Support\
**Created:** [May 10, 2021, 6:43pm UTC](https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795 "2021-05-10T18:43:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Palafox](https://bisq.community/user_avatar/bisq.community/palafox/32/3015_2.png) [@Palafox](https://bisq.community/u/Palafox)\
**Post date:** [May 10, 2021, 6:43pm UTC](https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795/1 "2021-05-10T18:43:35Z")

</div>

Hello Bisquists,

I have downloaded Bisq 1.6.4

OS: MacOS Mojave

I did the regular step to verify the binary:

```auto
gpg --digest-algo SHA256 --verify Bisq-1.6.4.dmg{.asc*,}

```

It worked fine.

However, there’s an issue with verifying the jar file in the bundle:

```auto
$ shasum -a256 desktop-1.6.4-all.jar
6ccd8b2d55ffbe58ea7498daffac287e719461528eec6f41ec1268280305362e desktop-1.6.4-all.jar

```

Above output does not match the content of the file `desktop-1.6.4-all.jar.SHA-256` which is also provided inside the bundle:

```auto
4d37b175aa0e75010d4acb526dadccbed242732630131c7226286009c7eba6c4

```

---

<div class="post-metadata">

**Author:** ![njpl](https://bisq.community/letter_avatar/njpl/32/6_22734026db12803ebb3e059622ac3534.png) [@njpl](https://bisq.community/u/njpl)\
**Post date:** [May 10, 2021, 6:52pm UTC](https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795/2 "2021-05-10T18:52:57Z")

</div>

Hi @Palafox,

I’m replying to your post to +1 you on this problem.  
Exact same issue here on MacOS Big Sur… The SHA-256 checksum provided in the release file (Bisq-1.6.4.jar.txt) doesn’t match the one I computed locally or that of this new file (desktop-1.6.4-all.jar.SHA-256)

---

<div class="post-metadata">

**Author:** ![Palafox](https://bisq.community/user_avatar/bisq.community/palafox/32/3015_2.png) [@Palafox](https://bisq.community/u/Palafox)\
**Post date:** [May 10, 2021, 6:57pm UTC](https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795/3 "2021-05-10T18:57:08Z")

</div>

Thanks for confirming on your side.

---

<div class="post-metadata">

**Author:** ![Palafox](https://bisq.community/user_avatar/bisq.community/palafox/32/3015_2.png) [@Palafox](https://bisq.community/u/Palafox)\
**Post date:** [May 11, 2021, 11:55am UTC](https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795/4 "2021-05-11T11:55:41Z")

</div>

Someone’s looking into it:

> thanks for reporting this. The build and packaging process did indeed change in v1.6.3/1.6.4 so we might have overlooked smth with the hash calculation. Looking into it

On Keybase: keybase://chat/bisq#support/23301

---

<div class="post-metadata">

**Author:** ![christoph](https://bisq.community/user_avatar/bisq.community/christoph/32/1252_2.png) [@christoph](https://bisq.community/u/christoph)\
**Post date:** [May 11, 2021, 1:38pm UTC](https://bisq.community/t/verifying-jar-file-after-installation-signature-mistmach/10795/5 "2021-05-11T13:38:24Z")

</div>

Yes, the hash verification doesn’t work right now as we get different jars on different OSes because of the new build that optimizes the jar for each OS. But what surprises me is that the jar you compute locally on macOS Big Sur is different to the one in Bisq.1.6.4.jar.txt as it is the one from the macOS jar build (which I do on a macOS Big Sur instance). I’ll have to double check if it is not a deterministic jar generation anymore. Did you build master or the release tag you compared with?