Skip to content

VERIFYING-RELEASES.md

Latest commit

 

History

History
85 lines (59 loc) · 2.24 KB

VERIFYING-RELEASES.md

File metadata and controls

85 lines (59 loc) · 2.24 KB
Raw

Verifying AetherSDR Releases

Signing Overview

Platform Signing Method
Linux AppImage GPG detached signature (.asc)
Windows .exe GPG detached signature (.asc)
Windows .zip GPG detached signature (.asc)
Source archive GPG detached signature (.asc)
macOS DMG Apple codesign + notarization
macOS .pkg Apple codesign + notarization

Each release also includes a GPG-signed SHA256SUMS.txt covering all Linux and source artifacts.

GPG Key Fingerprint

B765 6E6B CB2E 022B 79F0  F97B 5578 D10E 3D59 18F3

Import the Public Key

From the repository:

curl -sSL https://raw.githubusercontent.com/ten9876/AetherSDR/main/docs/RELEASE-SIGNING-KEY.pub.asc | gpg --import

Or from keys.openpgp.org:

gpg --keyserver keys.openpgp.org --recv-keys <KEY_ID>

Verify a Linux Download

Option 1: Verify the artifact directly

gpg --verify AetherSDR-v1.0.0-x86_64.AppImage.asc AetherSDR-v1.0.0-x86_64.AppImage

Option 2: Verify checksums first, then check the file

gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
sha256sum -c SHA256SUMS.txt

Expected output should show "Good signature from AetherSDR Release Signing".

GPG is typically pre-installed on Linux. If not:

# Arch
sudo pacman -S gnupg

# Debian/Ubuntu
sudo apt install gnupg

macOS Users

The DMG and .pkg are Apple notarized. macOS Gatekeeper verifies the Apple signature automatically — no manual steps required.

Windows Users

The Windows .exe installer and .zip portable build are GPG-signed. Windows SmartScreen may still show a warning because the binaries are not Authenticode-signed. This is expected for open-source projects without an EV code signing certificate. To verify the download:

# Install Gpg4win from https://gpg4win.org/
gpg --import RELEASE-SIGNING-KEY.pub.asc
gpg --verify AetherSDR-Setup-v0.7.12.exe.asc AetherSDR-Setup-v0.7.12.exe

Commit Signing

All commits on main must be GPG-signed by their author. GitHub displays a green "Verified" badge on signed commits. Contributors should set up commit signing with their personal GPG key — see CONTRIBUTING.md for setup instructions.