Verifying snapshots with signify

I use the signify tool to cryptographically sign all software downloads you will find on this site and on git.oriole.systems.

Whilst you technically don’t need signify to verify the integrity of downloaded files, I strongly recommend using it to also verify the signature. A portable version of the tool is available here.

Using my personal overlay

If you happen to use Gentoo, feel free to use my personal overlay. You only need to enable the verify-sig USE flag to verify the downloaded tarballs.

Obtaining the signature and checksum

Whether or not you decide to use signify to verify downloaded files, you need to obtain the detached signature linked on the respective project page or git repository¹. It contains the signature as well as the checksum.

Obtaining the public key

To fully verify a download with signify, first obtain my public key. I keep a copy of the same key on DNS, feel free to verify it therewith:

$ drill TXT releasekey.oriole.systems

Another copy of the key exists on the Libera Chat IRC servers, in my taxonomy data:

/msg NickServ taxonomy wolf

You may want to keep the public key saved on your system for future verifications.

Verification with signify

Once you have downloaded my public key, run the following to verify your download:

$ signify -C -p release.pub -x <snapshot>.asc
Signature Verified
<snapshot>: OK

Verification with sha256sum

Alternatively, if you don’t want to install signify, you can use the sha256sum tool to only verify the integrity of the download:

$ tail -n1 <snapshot>.asc | sha256sum -c
<snapshot>: OK

Verification of the corresponding commit

Every tarball hosted here contains its corresponding commit ID in the global extended pax header². Therefore, if a tarball is signed, it may be used to verify a commit and all of its ancestors.

To do so, place the tarball in the cloned git repository first. If you already have the detached signature, you may verify the tarball normally like shown above. Otherwise, you can fetch the signatures directly from the repository:

$ git fetch origin refs/notes/signatures/tar.gz:refs/notes/signatures/tar.gz

Now you can verify the tarball like so:

$ git notes --ref=signatures/tar.gz show <version> | signify -Cp release.pub -x -
Signature Verified
<snapshot>: OK

Once verified, you can extract the commit using git-get-tar-commit-id(1) and show it:

$ gzip -d -c <snapshot> | git get-tar-commit-id | xargs git show