Trust and verification

Security

Information about release signing, public key publishing, and independent verification.

What a release publishes

Each release should ship with a predictable verification bundle:

  • The release artifact itself
  • A checksum file such as SHA256SUMS
  • A detached GPG signature such as [release-artifact].asc
  • An optional RFC3161 token such as [release-artifact].asc.tsr
  • Release metadata identifying the version, source commit, and publication date

What a user should verify

Consumers should be able to validate the chain independently:

  • The armored public key matches the published fingerprint
  • The signature is made by the expected key
  • The signature matches the release artifact
  • The checksum matches the release artifact
  • When present, the RFC3161 token covers the detached signature and chains to a trusted TSA
Public release key

Key details

Confirm the fingerprint before trusting the public key or any release signed by it.

Fingerprint
A3B3 64C1 6339 CBBD 72D9 827A AF12 6F61 E254 323B
Key ID: ed25519/AF126F61E254323B Status: Active Algorithm: Ed25519 Rotation policy: Yearly, expires 2027-04-09 
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEadgIeRYJKwYBBAHaRw8BAQdAlQC+8WdFYUyZ41VBe1RRhNkkawe0hh/jZrx1
9ypD2p+0QVJlbGVhc2UgVGVhbSAoU2ludXNvaWRhbCBTeXN0ZW1zIEFCKSA8aW5m
b0BzaW51c29pZGFsc3lzdGVtcy5jb20+iJkEExYKAEEWIQSjs2TBYznLvXLZgnqv
Em9h4lQyOwUCadgIeQIbAwUJAeEzgAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIX
gAAKCRCvEm9h4lQyO1MBAP4hXpbMA04/rryPinIm6eHo1nr1lguadreYsI6RMd9G
5gEAxS/OANi+rRQ9llsBdnARYxCGP2HxhvT87wp40PS4vgG4OARp2Ah5EgorBgEE
AZdVAQUBAQdAf1aiQLxCglYQexjOAhOy5z3yPZejHhtf6GcR9HgW7jsDAQgHiH4E
GBYKACYWIQSjs2TBYznLvXLZgnqvEm9h4lQyOwUCadgIeQIbDAUJAeEzgAAKCRCv
Em9h4lQyO8BgAP9gEIv3qXmiHeFx4uIGIGscHt7qEixhM9M8usiB7lGptwD+M6m9
1rKWw5N78R8cptPSiDELZO6vUu/e7nej7JdWGAA=
=7SEc
-----END PGP PUBLIC KEY BLOCK-----
Verification

Suggested operator workflow

1. Import the key and confirm the fingerprint

curl -O https://releases.sinusoidalsystems.com/security/signing-key.asc
gpg --import signing-key.asc
gpg --fingerprint AF126F61E254323B

2. Verify the detached GPG signature

# Download the release artifact, its signature, SHA256SUMS, and
# the RFC3161 token when the release provides one.
gpg --verify release-artifact.asc release-artifact

3. Verify the release artifact checksum

sha256sum -c SHA256SUMS

4. Verify the RFC3161 timestamp token

# Inspect the token:
openssl ts -reply -in release-artifact.asc.tsr -text
# Look for the TSA's claimed time in the output.

# Verify it against the detached signature using the TSA trust chain:
openssl ts -verify \
  -data release-artifact.asc \
  -in release-artifact.asc.tsr \
  -CAfile tsa-ca.pem

The displayed TSA time is the time asserted by the timestamp authority. A successful Verification: OK confirms that the token covers this detached signature and chains to the trusted TSA certificate. Timestamp tokens are optional for historical releases. tsa-ca.pem is the TSA's trusted CA certificate or chain; it is separate from the release files and should be obtained from the configured timestamp authority.

Build trust into every release