Skip to content

VERIFY.md

Latest commit

 

History

History
141 lines (93 loc) · 4.02 KB

VERIFY.md

File metadata and controls

141 lines (93 loc) · 4.02 KB
Raw

Verify Your Download

Every official Amonite release ships with signed files and checksums, so you can confirm authenticity and integrity before installing. Verification uses the Amonite Release Signing Key.

Required files

From the release page, download:

  • the ISO image (amonite-<version>-amd64.iso or amonite-lite-<version>-amd64.iso);
  • *.iso.asc;
  • SHA256SUMS;
  • SHA256SUMS.asc.

release.json and release.json.asc are optional but useful. Current downloads are listed in INSTALL.md and on amonite.org/downloads.

You also need the official Amonite Release Signing Key:

security/amonite-signing-key.asc

The signing key is maintained separately from individual releases because it represents the long-term identity of the Amonite Project. Import it once; it should remain unchanged across releases. A new key is published only if the current one is revoked, compromised, or intentionally replaced.

Import the Release Signing Key

gpg --import security/amonite-signing-key.asc

Then check that its fingerprint matches the official fingerprint exactly:

0AFF 5507 8845 4862 6087  F84A 5E1E 335B 601F B44B

If it does not match, do not continue.

Verify the checksum file

gpg --verify SHA256SUMS.asc SHA256SUMS

Expected result:

Good signature from
"Manuel Gil (Official Release Signing Key) <security@amonite.org>"

You may also see:

WARNING: This key is not certified with a trusted signature.

That warning is normal when you have imported the key but have not yet established personal trust for it. It does not mean the signature is invalid.

Verify the installation image checksum

sha256sum --check SHA256SUMS

Expected result for the file you downloaded:

amonite-<version>-<architecture>.iso: OK

If checksum verification fails, do not use the ISO. Download the release again and repeat verification.

Published SHA-256 values for the current Alpha releases:

Image SHA-256
amonite-1.0.0-alpha.2-amd64.iso 9511d94b8f35735d2c94d74f8027a26ce9f61b1057637be1d34547575fda19a9
amonite-lite-1.0.0-alpha-amd64.iso a0b9f7334aae474ac53cc2fb255975cb67c8727c5f409762a3a9ab3702a95691

Always prefer the signed SHA256SUMS file from the release itself over checksums copied from secondary sources.

Verify the ISO signature

gpg --verify \
    amonite-<version>-<architecture>.iso.asc \
    amonite-<version>-<architecture>.iso

Expected result:

Good signature from
"Manuel Gil (Official Release Signing Key) <security@amonite.org>"

Verify release metadata (optional)

If you downloaded release.json and release.json.asc:

gpg --verify release.json.asc release.json

release.json identifies the product, edition, version, codename, architecture, and artifact checksums for automation and cross-checking.

Verification complete

The download is verified when all of the following are true:

  • the Release Signing Key fingerprint matches the published fingerprint;
  • SHA256SUMS carries a valid OpenPGP signature;
  • the ISO checksum matches the published checksum;
  • the ISO carries a valid OpenPGP signature.

If any step fails, do not install the downloaded image.

After verification, continue with INSTALL.md.

Official Release Signing Key

Manuel Gil
(Official Release Signing Key)
<security@amonite.org>

Fingerprint:

0AFF 5507 8845 4862 6087  F84A 5E1E 335B 601F B44B

This key signs official Amonite releases and nothing else. The fingerprint published here, on the official website, and in the key file must always be identical.

Key file: security/amonite-signing-key.asc