What you need
GnuPG, the installer, matching .asc signature, public CH-J key and an independently trusted expected key fingerprint.
Procedure
- Choose your platform on the releases page. In the details, download the package, its matching .asc signature and the public signing key.
- Display the key fingerprint with the command below. Compare it through an independent trusted channel; downloading a key alongside a package does not establish its identity.
- Import the verified key and run gpg --verify with the exact signature and package filenames. Check the result and the identity of the signing key.
- Also compare the complete SHA-512 with the catalog. Do not run the file if its signature fails or checksums differ.
Application updater and APT repository — existing key
pub (SC): 0D92 778A D8EC F85C 80E3 9248 48F2 433A D9CD F453sub (S): F3EA 1875 CBCF 63C8 9B2E D897 4402 8841 DE4E C7E4
Public OpenPGP key · ch-j-signing-public.asc
gpg --show-keys --with-subkey-fingerprint ch-j-signing-public.asc
Signing .deb packages during builds — new separate key
pub (SC): BC75 DC9E 5757 88C7 4189 5E82 D7F2 C5F4 7535 F7D7sub (S): F503 5C4D 5F8E 139C 507B 00CA DEB3 6BB0 DE62 F640
Public OpenPGP key · ch-j-deb-signing-public.asc
gpg --show-keys --with-subkey-fingerprint ch-j-deb-signing-public.asc
Public OpenPGP key · Release archive
gpg --show-keys --fingerprint ch-j-signing-public.asc gpg --import ch-j-signing-public.asc gpg --verify <file>.asc <file>
Download the package and its .asc file from the same release details. Check the public key fingerprint through an independent trusted channel, import the key and run gpg --verify. Then compare the complete SHA-512 with the catalog. Do not run the file if verification fails or values differ. Replace <file> with the actual filename.
Limitations and checking results
A valid signature verifies the file against that key. Establishing trust in the key is a separate step; Good signature alone is insufficient.
OpenPGP does not replace a Windows publisher signature or Apple notarization. Alpha packages may trigger operating system warnings.
Alpha and Beta development builds are available. Before using them on important systems, review the limitations of individual features and prepare backups.
