by the darktable project · GPL-3.0
Photography workflow application and raw developer
These URLs are the ones the darktable project declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what the darktable project published. Delete it.
Windows · PowerShell
Get-FileHash "darktable-5.6.0-win64.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "darktable-5.6.0-win64.exe"Expected output
b42989195dfff44540c0b767b407987329ca99853612304cbbf14c48d1d3f803
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 29.8 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 2 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions darktable registers itself to handle.
The installer comes from a recognised distribution platform rather than the darktable project's own domain. That is normal for this kind of software and not a red flag by itself.
The installer on this page comes with the SHA-256 the darktable project declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 95/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id darktable.darktable --exactUpgrade later
winget upgrade --id darktable.darktableWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of darktable, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
DF3B9F2F9F1375B9166C2FB2F1503455C3CEAA44C702B8A9144419E65E0CFDF9
655CE83046F27D20E1385BFFA1E5471B702033083772F65DB1FE1A07445C3EB8
C470779D92A08345C6F9B65457484E2FE4406537B0604A6E0DF0339C81059158
4C1499E9D137EFCD87E8B70FB6A0374F7139F1D0F0C49BAEAC9923EF7DF7BDAA
2EA64535F1D42793F2EF53AEC971ECA43818748ABA036B5E778624297EA0FB34
40444D5C7D310B1E1E859BD6B7C5D5E35D538A7BF9AD3E918B0E883C971451EA
A7255EAAD0CD36AD4771441EF5AD052D3069A90991DE50F9B394A7C235DE61E3
3F3557281A24F61080181CBDE09C3D0F9853F81FF08485247E844AFA9B2171A6
70DCA4F5F3C4FEC897A6561484FB14F81709ACA3185373D9118B630D24AE2098
23A4831CA52C707984B64CC6B9122526E96606CE86B04A0906FE32FD8327D956
31C4D6C522818EDA87E48DF44F267AFD531339EF9D374FA02D44891E3755F7B5
748E617D36F810890FCC7829FDF0E9999DA2906B20293A2AC919808F80709E27
96B584EDBC7D65F26B76DC7C57B9DCE6FE33792B839F0AC4C712CD6834051DAD
D0E09EFB2F74BEAE9F5387A296D366C160D9FB87E571C9559C53CD0111B7B955
9ED13CC0972C4473C7E5AC69B3393E6636BA9E2A2CF8B8B9E2A51882288235D1
C74D76F9FEEFC5648C41938BF430B261D3A3308DF0EF87085BE590B5A5D1110D
34B4C1748FFE7AC66C3C79AD474B86A7AAA01BA296F8CD21929FE8024EBF3262
986B7BD1BEA817013F8B7AB6E93907AC3B8B93F66671612E3F36A5C40D321EEA
251453A776B7749B7F7701B7B58E6B9EBA7747370C228BFA298F2053200D9FEC
29DEE565292A4A72443874BB970663D46420F5A9BA74A5ACFCB3251A48C86F7C
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every darktable version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories the darktable project and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to darktable — just other entries, each with its own official URL and published hash.