QSO Graph Desktop

A desktop home for your station. Your callsigns, your logins for the services hams use, and the places you operate from, kept safely in one place, with Parks On the Air, the sun and the moon, band conditions and ADIF's definitions a click away. Free software, on Windows, Linux and macOS, and everything you enter stays on your computer.

Download

Releases page → No account is needed. Open the newest numbered release (QSO Graph Desktop 0.x.y), scroll to its Assets, and take the file for your computer:

Computer	File	Then
Windows	…-win-x64.exe	Run it. From 0.2.0 the installer is signed by Gregory Beam (KI7MT). The signature is new, so Edge may say the file isn't commonly downloaded (choose Keep), and Windows may say it protected your PC: More info shows Publisher: Gregory Beam, then Run anyway. Installers before 0.2.0 aren't signed. A Microsoft Store listing, without those warnings, is planned.
Linux	…-linux-x86_64.AppImage (PC) or …-linux-arm64.AppImage (Raspberry Pi 5)	Mark it executable and run it; it updates itself. Ubuntu 22.04 and later need FUSE (sudo apt install libfuse2t64 on 24.04). A .deb and an .rpm are there too, or install from our apt and dnf repository and it updates with your system.
macOS (Apple silicon)	…-mac-arm64.dmg	Drag the app to Applications. Signed by Greg Beam (KI7MT) with an Apple Developer ID, and notarized by Apple. Or brew install qso-graph/tap/qso-graph-desktop.

Each platform also has a portable .zip, and SHA256SUMS.txt lets you check any download. The application checks for updates once a day (Release or Beta, or off, in Settings) and never restarts without asking. The install page has the details.

Verify your download

Anyone can copy this project and publish a build of their own. An official download proves it is one, three ways. If it doesn't verify, it isn't an official build.

• Who published it.
  • Windows: right-click the .exe → Properties → Digital Signatures. It says Gregory Beam.
  • Linux: a package from our repository is checked by apt or dnf against our signing key, E4EC 9751 F1AA 66AB 2BA5 08EF 0410 96B9 A6EB D256. A file from the Releases page is covered by the next two checks.
  • macOS: in Terminal, spctl -a -vv "/Applications/QSO Graph Desktop.app" says accepted, Notarized Developer ID, Developer ID Application: Greg Beam.
• That it wasn't changed. Its SHA-256 matches the release's SHA256SUMS.txt: on Windows, certutil -hashfile <file> SHA256; on Linux, sha256sum -c SHA256SUMS.txt --ignore-missing; on macOS, shasum -a 256 <file>.
• Where it came from. GitHub signs, in a public log, that each file was built by this repository's CI from a named commit. Nobody can make that for this repository, a copy of it included. With GitHub's gh: gh attestation verify <file> -R qso-graph/qso-graph-desktop. Every one is on the attestations page.

Releases, Betas and Dailies. A Release (0.6.0) is for everyone. A Beta (0.6.0-beta.1) is the next release before it is final, offered in the app to those who choose Beta in Settings. A Daily (Daily build of 0.6.0) is the day's build of main, on the Releases page for 7 days and never offered by the app: for trying what is coming, not for running your station. docs/RELEASES.md explains them.

What you can do

• Keep your callsigns and their logins for QRZ.com, QRZ Logbook, Logbook of The World, eQSL, HamQTH and Club Log, in your computer's own credential store: Credential Manager on Windows, the keyring on Linux, Keychain on macOS. Passwords are never shown again and never leave the computer.
• Keep your Locations: grid, DXCC, zones, county and ARRL section the way LoTW wants them, and your POTA, SOTA, WWFF and IOTA references. Start one from a park or a summit in a click.
• Parks On the Air: the parks near you, even with no internet; who is on the air from a park right now; and the parks in your area that have been activated least.
• Astro: sunrise, sunset, twilight, the moon, and the gray line on a world map.
• Conditions: solar flux, the K and A indices, NOAA's space weather and a band-by-band outlook.
• ADIF Lookup: every ADIF field and list value, in ADIF's own words.
• Back up and restore your callsigns and Locations, and run it portable from a USB stick.

The User Guide walks through each, and CHANGELOG.md says what is new in each release.

Yours, and only yours

There is no account to make and no server of ours. Your callsigns, Locations, settings and logs stay on your computer, and your logins stay in its credential store. The application goes online only for what you ask of it, such as reference data, a page of outside data, or the daily update check, and sends nothing about you. PRIVACY.md says exactly what it does.

Every connection goes through the application's own core, over HTTPS, using AWS-LC's FIPS-validated cryptographic module on Windows and Linux. The windows and the extensions open no connection of their own, and nothing listens for one. SECURITY.md says how to report a security problem.

Extensions, and no lock-in

Everything past callsigns and Locations is an extension, built on the same extension API anyone can build on, and you choose which ones run: each starts off until you turn it on. The core gives every extension your identities without ever showing it a password, verified reference data, its own storage, and one look and way of working, so an extension author writes only the ham part.

Today the application loads its own official extensions; extensions by other authors arrive once the sandbox they run in is finished. Want to write one? See CONTRIBUTING.md.

Building from source

You need the Node version in .node-version, Rust, CMake and Go. Then make setup and make start. CONTRIBUTING.md has the rest: building, testing, the specification and how changes are made.

License

GPL-3.0-or-later. Third-party material and its licenses are in NOTICE. Thanks to everyone in CONTRIBUTORS.md.