QSO Graph Desktop
A desktop home for your station. Your callsigns, your logins for the services hams use, and
the places you operate from, kept safely in one place, with Parks On the Air, the sun and the moon,
band conditions and ADIF's definitions a click away. Free software, on Windows, Linux and macOS,
and everything you enter stays on your computer.
Download
Releases page → No account is needed.
Open the newest numbered release (QSO Graph Desktop 0.x.y), scroll to its Assets, and take the
file for your computer:
| Computer | File | Then |
|---|
| Windows | …-win-x64.exe | Run it. From 0.2.0 the installer is signed by Gregory Beam (KI7MT). The signature is new, so Edge may say the file isn't commonly downloaded (choose Keep), and Windows may say it protected your PC: More info shows Publisher: Gregory Beam, then Run anyway. Installers before 0.2.0 aren't signed. A Microsoft Store listing, without those warnings, is planned. |
| Linux | …-linux-x86_64.AppImage (PC) or …-linux-arm64.AppImage (Raspberry Pi 5) | Mark it executable and run it; it updates itself. Ubuntu 22.04 and later need FUSE (sudo apt install libfuse2t64 on 24.04). A .deb and an .rpm are there too, or install from our apt and dnf repository and it updates with your system. |
| macOS (Apple silicon) | …-mac-arm64.dmg | Drag the app to Applications. Signed by Greg Beam (KI7MT) with an Apple Developer ID, and notarized by Apple. Or brew install qso-graph/tap/qso-graph-desktop. |
Each platform also has a portable .zip, and SHA256SUMS.txt lets you check any download. The
application checks for updates once a day (Stable, Early or Previews, or off, in Settings) and never
restarts without asking. The install page has the details.
Verify your download
Anyone can copy this project and publish a build of their own. An official download proves it is
one, three ways. If it doesn't verify, it isn't an official build.
- Who published it.
- Windows: right-click the
.exe → Properties → Digital Signatures. It says
Gregory Beam.
- Linux: a package from our repository is checked by apt or dnf
against our signing key,
E4EC 9751 F1AA 66AB 2BA5 08EF 0410 96B9 A6EB D256. A file from the
Releases page is covered by the next two checks.
- macOS: in Terminal,
spctl -a -vv "/Applications/QSO Graph Desktop.app" says accepted,
Notarized Developer ID, Developer ID Application: Greg Beam.
- That it wasn't changed. Its SHA-256 matches the release's
SHA256SUMS.txt: on Windows,
certutil -hashfile <file> SHA256; on Linux, sha256sum -c SHA256SUMS.txt --ignore-missing;
on macOS, shasum -a 256 <file>.
- Where it came from. GitHub signs, in a public log, that each file was built by this
repository's CI from a named commit. Nobody can make that for this repository, a copy of it
included. With GitHub's
gh:
gh attestation verify <file> -R qso-graph/qso-graph-desktop. Every one is on the
attestations page.
The Preview (Preview of 0.x.y, at the top of the Releases page) is the newest build of
main, rebuilt each night it has changed: for testing what is coming, not for running your
station. docs/RELEASES.md explains versions, previews and releases.
What you can do
- Keep your callsigns and their logins for QRZ.com, QRZ Logbook, Logbook of The World, eQSL,
HamQTH and Club Log, in your computer's own credential store: Credential Manager on Windows, the
keyring on Linux, Keychain on macOS. Passwords are never shown again and never leave the computer.
- Keep your Locations: grid, DXCC, zones, county and ARRL section the way LoTW wants them, and
your POTA, SOTA, WWFF and IOTA references. Start one from a park or a summit in a click.
- Parks On the Air: the parks near you, even with no internet; who is on the air from a park
right now; and the parks in your area that have been activated least.
- Astro: sunrise, sunset, twilight, the moon, and the grey line on a world map.
- Conditions: solar flux, the K and A indices, NOAA's space weather and a band-by-band outlook.
- ADIF Lookup: every ADIF field and list value, in ADIF's own words.
- Back up and restore your callsigns and Locations, and run it portable from a USB stick.
The User Guide walks through each, and CHANGELOG.md says what is
new in each release.
Yours, and only yours
There is no account to make and no server of ours. Your callsigns, Locations, settings and logs stay
on your computer, and your logins stay in its credential store. The application goes online only
for what you ask of it, such as reference data, a page of outside data, or the daily update check,
and sends nothing about you. PRIVACY.md says exactly what it does.
Every connection goes through the application's own core, over HTTPS, using AWS-LC's
FIPS-validated cryptographic module on Windows and Linux. The windows and the extensions open no
connection of their own, and nothing listens for one. SECURITY.md says how to report
a security problem.
Extensions, and no lock-in
Everything past callsigns and Locations is an extension, built on the same extension API anyone
can build on, and you choose which ones run: each starts off until you turn it on. The core gives
every extension your identities without ever showing it a password, verified reference data, its
own storage, and one look and way of working, so an extension author writes only the ham part.
Today the application loads its own official extensions; extensions by other authors arrive once
the sandbox they run in is finished. Want to write one? See
CONTRIBUTING.md.
Building from source
You need the Node version in .node-version, Rust, CMake and Go. Then make setup and
make start. CONTRIBUTING.md has the rest: building, testing, the specification
and how changes are made.
Licence
GPL-3.0-only. Third-party material and its licences are in NOTICE. Thanks to
everyone in CONTRIBUTORS.md.
