Download · APPCHK CLI 1.1.0

Get the scanner.

One native binary for macOS, Linux and Windows, with nothing else to install. Free forever, with every check. Scans run offline and nothing is uploaded.

macOS

13 Ventura or later

Apple siliconM1 and later · 15.9 MB IntelIntel Macs · 17.0 MB

Windows

10 or later

x64Intel or AMD · 18.1 MB ArmSnapdragon and other Arm laptops · 11.2 MB

Linux

glibc 2.17 or later

x86_64Intel or AMD · 14.9 MB arm64Graviton, Ampere, Raspberry Pi 4 and later · 13.3 MB

Version 1.1.0 · signed for macOS and Windows · checksums signed with minisign

Not sure which one? On macOS and Linux, uname -m prints arm64 or aarch64 for the arm64 files and x86_64 for the others. On Windows, Settings › System › About shows the system type: x64 or ARM-based.

02

Requirements

Nothing else to install.

APPCHK uses only what the operating system already has: no Java, Android SDK, Xcode or Python, and no runtime to install first.

macOS

macOS 13 Ventura or later
Apple silicon or Intel
Uses only libraries built into macOS

Linux

glibc 2.17 or later, which every mainstream distribution since 2012 has (ldd --version shows yours)
x86_64 or arm64
Needs nothing beyond glibc; musl distributions such as Alpine are not supported

Windows

Windows 10 or later
x86_64 or arm64 (Windows on Arm laptops)
Uses the C runtime built into Windows 10 and 11; no Visual C++ package to install

Network: only appchk feeds update connects, over HTTPS to osv-vulnerabilities.storage.googleapis.com. Its trusted root certificates are built in, so no certificate package is needed. Scans never use the network.

03

Check the download

Signed, and you can prove it.

Every release's SHA256SUMS is signed with the APPCHK release key. Check the signature, then your file against SHA256SUMS: that proves the file is the one we published, unchanged.

SHA256SUMS · 1 KB SHA256SUMS.minisig · 1 KB

$ minisign -Vm SHA256SUMS -P RWTpNVfh7QXk3KbM6Q4phFMWX5sp7uimttcvUmAmCJvVf3ieasWBUeyg
Signature and comment signature verified
Trusted comment: APPCHK 1.1.0 release checksums
$ shasum -a 256 --ignore-missing -c SHA256SUMS
appchk-1.1.0-aarch64-apple-darwin: OK

Release public key RWTpNVfh7QXk3KbM6Q4phFMWX5sp7uimttcvUmAmCJvVf3ieasWBUeyg key ID DCE405EDE15735E9

To get minisign: macOS brew install minisign · Debian 12 or later and Ubuntu 24.04 or later sudo apt install minisign · Fedora, and RHEL with EPEL, sudo dnf install minisign · Windows: download it from the minisign page. On Windows without minisign, Get-FileHash in PowerShell checks a file against SHA256SUMS, but not who signed it.

macOS

Signed with an Apple Developer ID and notarized by Apple. On the first run macOS checks the notarization online.

Windows

Signed with an Authenticode certificate and timestamped. SmartScreen may still warn about a new program: choose More info, then Run anyway.

Linux

Linux has no system check of program signatures. The minisign signature on SHA256SUMS is what proves where the file came from.

04

Install

Put it on your PATH.

macOS

Use the Intel file name on an Intel Mac. Without sudo, any folder on your PATH works.

chmod +x appchk-1.1.0-aarch64-apple-darwin
sudo mv appchk-1.1.0-aarch64-apple-darwin \
  /usr/local/bin/appchk

Linux

Use the arm64 file name on arm64. Without sudo, use ~/.local/bin.

chmod +x appchk-1.1.0-x86_64-unknown-linux-gnu
sudo mv appchk-1.1.0-x86_64-unknown-linux-gnu \
  /usr/local/bin/appchk

Windows (PowerShell)

Moves the program to your user programs folder; use the arm64 file name on Windows on Arm. Then add that folder to your user PATH and open a new terminal.

$dir = "$env:LOCALAPPDATA\Programs\appchk"
New-Item -ItemType Directory -Force $dir
Move-Item .\appchk-1.1.0-x86_64-pc-windows-gnu.exe `
  "$dir\appchk.exe"

05

First run

Scan your first build.

$ appchk --version
appchk 1.1.0
$ appchk doctor
$ appchk feeds update
$ appchk scan MyApp.apk

Good to know

appchk scan reads APK, AAB and IPA files
appchk feeds update fetches the OSV advisory feed; it is the only command that uses the network
Exit codes for CI: 0 clean, 1 findings at your threshold, 2 usage error, 3 incomplete
Reports: terminal, JSON, HTML, PDF, SARIF and CycloneDX

06

What is in 1.1.0

The first public release.

Packages

APK and Android App Bundle, every module
IPA: Info.plist, ATS, privacy manifests, Mach-O, entitlements, profile
Signatures verified, not just detected

Findings

119 rules: 68 Android, 51 iOS, mapped to MASVS, MASWE, MASTG and CWE
App Store and Google Play readiness checklists
Secrets, 432 trackers, OSV advisories for Maven

Pipelines

Deterministic exit codes and --fail-on
Baselines with justifications and expiry dates
SARIF for code scanning, CycloneDX 1.7 SBOM

Not in this release: dynamic analysis, and vulnerability matching for native libraries and iOS dependencies.