Verify what you downloaded
The checksums file lists SHA-256 for the four platform archives (it does not cover the
installer or the jar). Compare the hash of your download against the line for that file:
Windows certutil -hashfile nuclr-<version>-windows-x64.zip SHA256
macOS shasum -a 256 nuclr-<version>-macos-aarch64.dmg
Linux sha256sum --ignore-missing -c nuclr-<version>-platform-archives-SHA256SUMS.txt
Updates
Commander checks for new releases in the background and stages them under your own
~/.nuclr/commander/updates directory, verifying the signature before it
runs one. Turn that off under Settings → “Check for updates automatically”.