Release signing key

Each konareef release has a file named SHA256SUMS and an SSH signature of that file, SHA256SUMS.sig. This page shows the key that makes the signature.

Fingerprint

SHA256:PZcAooVR2nAqULXK6Hbl9wD9mNTovl4chAIVVxWfbNs

Details

• Key type: ED25519 SSH signing key.
• What it signs: the SHA256SUMS file of the konareef release binaries. SHA256SUMS lists the SHA-256 digest of each binary.
• GitHub also lists the key for the account digitsu: https://api.github.com/users/digitsu/ssh_signing_keys.

How to check a release

The steps are in the README of the konareef repository: Verify a release. The README shows the same fingerprint. The fingerprint on this page and the fingerprint in the README must be the same. If they are not the same, or if a signature check fails, do not run the binary.