Download PATANYX

Version 0.9.62, for Windows and Linux. Free, and the core privacy protections always will be.

Prerelease

PATANYX is pre-1.0 and under active development. Behavior and formats may change between releases. The Linux build is the more exercised of the two; the Windows build is newer and still going through hardware testing. Treat this as prerelease software.

Windows PATANYX.exe · 38.1 MB · x86-64 Windows 10 or later. The WebView2 runtime is already present on current Windows; PATANYX uses it to render pages.

sha256
          34980709e45ea34473efe2f5d2e39510978ee19b561f8981346c9c360b5ded80

Linux PATANYX · 35.6 MB · x86-64 Needs WebKitGTK 2.52.5 or newer, which ships with Debian 13. Mark it executable after downloading: chmod +x PATANYX

sha256
          cb7736d6a948899db0470953d9bcc300f6b7925b998594e3a565ea544554497c

A note on the Windows warning

The Windows build is Authenticode-signed, so Windows can name the publisher: right-click the file, open Properties, and the Digital Signatures tab shows who signed it and when.

You may still see a SmartScreen warning. That is not a claim the file is unsigned or unsafe. SmartScreen weighs how much download history a certificate and a file have, and both are new here, so it warns until that history accumulates. Choose More info, then Run anyway. If you would rather have certainty than reassurance, verify the download below instead of trusting the absence or presence of a prompt.

Verify what you downloaded

Every release is signed with Sigstore, and the signature is recorded in a public, append-only log. The bundles are published beside the binaries on the releases page.

cosign verify-blob PATANYX.exe \
  --bundle PATANYX.exe.sigstore.json \
  --certificate-identity contact@edgexene.io \
  --certificate-oidc-issuer https://accounts.google.com

Or check the SHA-256 shown with each download above. On Windows: certutil -hashfile PATANYX.exe SHA256. On Linux: sha256sum PATANYX.

Updates

PATANYX updates itself from this site over its own signed channel. Each update is described by an Ed25519-signed manifest that the browser checks against a key compiled into it, so a compromise of the server, its DNS, or a certificate for it still cannot make an install accept a modified update. Checks happen on a schedule and a verified update can download in the background, but nothing installs until you choose to restart.