Verifying Downloads

PineHook's Expert Advisor runs inside MetaTrader with full access to your trading account: it can place orders, read balances, and modify positions. A tampered or trojan EA is the single highest-impact attack against users of a signal-relay platform, and we treat that risk accordingly.

Every release is published across two independent infrastructures so that compromising one of them is not enough to forge a binary that verifies cleanly:

1. The bundle ZIP is hosted on GitHub at PineHook/TradingView-Webhook-Relay. Each release is a tagged Release with the ZIP attached as a Release asset. The ZIP contains the EA .ex5 and the WebSocket .dll at their MQL5 install paths.
2. The SHA-256 hash is published on the same GitHub repo on three independent surfaces: the tagged Release (as a SHA256SUMS asset), an append-only releases/SHA256SUMS.txt on main, and a releases/LATEST.txt pointer to the current bundle.
3. The dashboard on pinehook.io fetches the hash from GitHub at page-load time and displays it next to the Download button. Because pinehook.io does not store the hash locally, a compromise of pinehook.io alone cannot forge the hash users see.

For the full trust story, see /docs/overview#security-model.

Why you should verify#

A SHA-256 hash is a 256-bit cryptographic digest of the file. Change a single byte and the hash changes entirely. There is no practical way for an attacker to produce a different file that hashes to the same value.

So if:

1. The hash shown on your PineHook Downloads page (fetched from GitHub) matches
2. The hash published on GitHub at releases/SHA256SUMS.txt matches
3. The hash you compute locally from the downloaded ZIP matches

then the bundle on your disk is the bundle PineHook published. If any two of those three don't agree, something is wrong. Stop. Do not extract or install. Email [email protected] with the three hashes and the time you downloaded, and we will investigate.

Always verify the ZIP, before extracting. Once you extract, you no longer have the file the dashboard hash refers to. If you want to additionally verify each extracted file, the GitHub Release page lists the per-file hashes for MQL5/Experts/PineHook.ex5 and MQL5/Libraries/PineHook.dll in the same SHA256SUMS asset.

One-line verification#

macOS / Linux#

sha256sum PineHook-0.0.5.zip

(macOS before Big Sur may need shasum -a 256 PineHook-0.0.5.zip instead of sha256sum.)

Windows (PowerShell)#

Get-FileHash -Algorithm SHA256 .\PineHook-0.0.5.zip

PowerShell capitalises the hash by default. Compare case-insensitively against the dashboard.

Windows (Command Prompt)#

certutil -hashfile PineHook-0.0.5.zip SHA256

Comparing against the dashboard#

On the Downloads page, the bundle card shows a truncated hash:

SHA-256  93a6650d3eb28be1…55069212   [Verified via GitHub ↗]

Click the copy icon next to it to put the full 64-character hash on your clipboard. Paste it next to your command output. They should be identical.

The "Verified via GitHub ↗" chip links directly to the tagged Release on GitHub, where you can see the SHA256SUMS asset alongside the bundle ZIP.

Comparing against GitHub (strongest verification)#

For the most thorough check, cross-reference the dashboard-displayed hash against GitHub's own publication:

curl https://raw.githubusercontent.com/PineHook/TradingView-Webhook-Relay/main/releases/SHA256SUMS.txt

You'll see every release ever published, grouped by date. Find the line matching your ZIP filename and compare it against both the dashboard and your local sha256sum output.

Even better, use sha256sum --check to verify your downloaded bundle against the official record in one shot:

curl -O https://raw.githubusercontent.com/PineHook/TradingView-Webhook-Relay/main/releases/SHA256SUMS.txt
sha256sum --ignore-missing --check SHA256SUMS.txt

The --ignore-missing flag makes sha256sum --check skip files you don't have locally and error loudly only on a genuine mismatch. Without it, sha256sum --check fails on every release in the append-only file that isn't in your directory, so pass --ignore-missing.

Worked example#

After downloading PineHook-0.0.5.zip:

$ sha256sum PineHook-0.0.5.zip
93a6650d3eb28be10b8fb3663f47e1b876a39f5ab108be0ef73dbace55069212  PineHook-0.0.5.zip

Copy the hash from the dashboard:

93a6650d3eb28be10b8fb3663f47e1b876a39f5ab108be0ef73dbace55069212

Copy the hash from GitHub:

$ curl -s https://raw.githubusercontent.com/PineHook/TradingView-Webhook-Relay/main/releases/SHA256SUMS.txt | grep PineHook-0.0.5.zip
93a6650d3eb28be10b8fb3663f47e1b876a39f5ab108be0ef73dbace55069212  PineHook-0.0.5.zip

All three match. The bundle is authentic.

If the hashes don't match#

Do not extract the file. A mismatch means one of:

1. The download was corrupted in transit. Re-download and recompute. This is the most common cause.
2. Your local network is intercepting HTTPS traffic. Some corporate or school networks, and certain "security" software, install their own root CA and MITM all TLS. Verify from a different network (a mobile hotspot is a good test).
3. The bundle has been tampered with. Stop. Do not proceed. Email [email protected] with (a) the hash you computed, (b) the hash the dashboard showed, (c) the hash GitHub served, (d) the time of the download, and (e) your approximate location or ISP. We will investigate.