Get MD Synth DAW

Arch and anything rolling is current by definition, and Mint, Pop!_OS and Zorin want whichever release tracks the Ubuntu above. System requirements in detail has the rest: what an export costs as a piece gets longer, every renderer backend and what it needs, which machines get no support, and how to measure the lot on your own machine.

Download the latest build from the Releases page, then either

• run the installer, which asks where to install and lets you leave out the Japanese, Chinese and Korean fonts, or
• unzip the portable archive anywhere and run mdd.

On Windows the installer checks the machine against the requirements above before it installs anything, and will not install on one short of the cores, memory or graphics memory they ask for.

Nothing else is needed. The portable archive keeps its settings beside itself rather than in your account directory, so it will happily live on a USB stick with your preferences intact. Keep the folder whole: the program reads its fonts and icons from the folders beside it, and says so in a box if they are missing rather than failing to open. It leaves out the Japanese, Chinese and Korean fonts, which are most of the size, and downloads the one a language needs when you pick it.

Every release file is signed with Sigstore as it is built, keylessly, so there is no signing key to trust and none to leak. A SHA256SUMS file goes out beside them. Check one either way:

# with the GitHub CLI, which checks the build provenance as well
gh attestation verify mdd-0.9.0-linux-x86_64-portable.tar.gz --repo MeguminBOT/md-synth-daw

# or with cosign alone, against the bundle published beside the file
cosign verify-blob mdd-0.9.0-linux-x86_64-portable.tar.gz   --bundle mdd-0.9.0-linux-x86_64-portable.tar.gz.sigstore   --certificate-identity-regexp '^https://github.com/MeguminBOT/md-synth-daw/'   --certificate-oidc-issuer https://token.actions.githubusercontent.com

Either one tells you the file came out of this repository's release workflow, at a named commit, and has not been touched since.

The in-app updater checks what it downloads against SHA256SUMS before it unpacks anything, and deletes a file that does not match. That catches a download that was cut short, corrupted, or served by something in the middle of the connection. It is not the same as the checks above: whoever could replace a release file could replace the list beside it, so the signature is what says the file is genuine, and that is the check worth running by hand on anything you did not build yourself.

git clone https://github.com/MeguminBOT/md-synth-daw.git
cd md-synth-daw
./mdd setup     # SDL3, miniaudio, stb, the codecs and the typefaces into vendor/
./mdd run       # build it and start it

Prerequisites, toolchains, the build file and how to add a check are all in docs/BUILDING.md.