Currently, Visual Studio Code extensions are not signed or verified on the
Microsoft Visual Studio Code Marketplace. Salesforce provides the Secure Hash
Algorithm (SHA) of each extension that we publish. To verify the extensions,
make sure that their SHA values match the values in the list below.

1. Instead of installing the Visual Code Extension directly from within Visual
   Studio Code, download the VS Code extension that you want to check by
   following the instructions at
   https://code.visualstudio.com/docs/editor/extension-gallery#_common-questions.
   For example, download,
   https://salesforce.gallery.vsassets.io/_apis/public/gallery/publisher/salesforce/extension/salesforcedx-vscode-core/40.9.0/assetbyname/Microsoft.VisualStudio.Services.VSIXPackage.

2. From a terminal, run:

shasum -a 256 <location_of_the_downloaded_file>

3. Confirm that the SHA in your output matches the value in this list of SHAs.

474b8c3aea9802f1e40dbf5cce46c454b26c1b938643a9335bcaa6264819f2ff  salesforcedx-vscode-apex-debugger-40.9.0.vsix
78a6a39d845d956d4fb34f3c39ca6bea9bfeb14ba6727ffa4151e1085eb2fcc2  salesforcedx-vscode-apex-40.9.0.vsix
b80af7f2c13ba9cd8b5558566b1d604f28fd73598b9931611b9f19de259fbfa0  salesforcedx-vscode-core-40.9.0.vsix
b5b9904e2205e3a6c4c7343fb92e18a036adfce8529ae22c7ccc07d405ef89b7  salesforcedx-vscode-lightning-40.9.0.vsix
4639c7ba2108323bedd8a56bd1c22a068c40136c56d30a0a072c32dd7cba2445  salesforcedx-vscode-visualforce-40.9.0.vsix
6fa0c3369e9c3753fd3157e13a070fa552d81f7f0a3d2bc552246fd5e6b14267  salesforcedx-vscode-40.9.0.vsix


4. Change the filename extension for the file that you downloaded from .zip to
.vsix.

5. In Visual Studio Code, from the Extensions view, select ... > Install from
VSIX.

6. Install the verified VSIX file.