Current build: 2026.08.20 — 1.90 GiB, one file, signed. Download it, verify the signature, drag it into Etcher (or dd). Nothing to reassemble: earlier builds were 2.9 GiB and had to ship as .part-00/ .part-01 because GitHub caps release assets at 2 GiB, and that cat step was the first thing standing between a person and a bootable stick. Channel pin: cicada-stable · Helium hash-locked in-tree. The hosted update mirror is live: images from this build point at it out of the box, and cicada-update (Settings → Security → Check updates) syncs on request. Nothing polls in the background.

# verify the signature FIRST — it is the step that matters
gpg --import cicada-stable.pub
gpg --verify cicada-2026.08.20-x86_64.iso.sha256.asc cicada-2026.08.20-x86_64.iso.sha256

# then confirm the bytes match the hash you just proved was signed
shasum -a 256 -c cicada-2026.08.20-x86_64.iso.sha256

1. Download the ISO + checksum from the same release Prefer the release assets page — not a random Drive link.
2. Verify the signature — this is the step that matters A checksum on its own authenticates nothing: whoever could replace the ISO could replace the hash sitting next to it. Only the signature tells you the image came from us.

   gpg --import cicada-stable.pub
   gpg --fingerprint stable@cicada.os
   # must equal: CAAC 3467 D0BB B357 231A  04A6 4755 854B FFDF 59F9
   gpg --verify cicada-*.iso.sha256.asc cicada-*.iso.sha256
   # want: "Good signature from Cicada.OS stable"

   Check that fingerprint against this page, not against the release — a key shipped beside the thing it signs proves only that both came from the same place.
3. Check the sha256

   shasum -a 256 -c cicada-*.iso.sha256

   This confirms the bytes match the hash you just proved was signed.
4. Flash (macOS example)

   diskutil list
   # confirm ~250GB stick diskN — wrong disk wipes that drive
   diskutil unmountDisk /dev/diskN
   sudo dd if=./cicada-YYYY.MM.DD-x86_64.iso of=/dev/rdiskN bs=4m status=progress
   sync
   diskutil eject /dev/diskN