Verify downloads

Why verify?

SHA256 checksums verify that a download wasn't corrupted in transit. Ed25519 signatures go further — they prove the download came from us.

SHA256 verification

Every release has .sha256 checksum sidecars:

sha256sum -c hugin-cli-linux-x86_64.sha256

Ed25519 verification

Ed25519 signatures prove authenticity — the signing key never leaves our CI. If a .sig sidecar is present for your download:

Using the Hugin CLI

hugin verify hugin-cli-linux-x86_64.tar.gz

Manual verification

With Python

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
import base64

pub_hex = "a61ff9262c4509a7879ddaa5a8d86345ef805f6ddced28b097bf58dae270618b"
pub_key = Ed25519PublicKey.from_public_bytes(bytes.fromhex(pub_hex))

with open("hugin-cli-linux-x86_64.tar.gz", "rb") as f:
    data = f.read()
with open("hugin-cli-linux-x86_64.tar.gz.sig") as f:
    sig_line = f.read().strip()

sig_b64 = sig_line.removeprefix("hugin-sig-ed25519:")
signature = base64.b64decode(sig_b64)

pub_key.verify(signature, data)
print("Signature valid.")

With OpenSSL (3.0+)

SIG_B64=$(cut -d: -f2 hugin-cli-linux-x86_64.tar.gz.sig)
echo "$SIG_B64" | base64 -d > /tmp/sig.raw

echo "MCowBQYDK2VwAyEAph/5JixFCaeHndqlqNhjRe+AX23c7Siwl79Y2uJwYYs=" | \
  base64 -d | openssl pkey -inform DER -pubin -outform PEM -out /tmp/release.pub

openssl pkeyutl -verify -pubin -inkey /tmp/release.pub \
  -rawin -in hugin-cli-linux-x86_64.tar.gz -sigfile /tmp/sig.raw

Signing key

Ed25519 public key:

Hex:    a61ff9262c4509a7879ddaa5a8d86345ef805f6ddced28b097bf58dae270618b

Base64: ph/5JixFCaeHndqlqNhjRe+AX23c7Siwl79Y2uJwYYs=

Machine-readable: GET /signing-key

Signature format

Each release artifact has a .sig sidecar:

hugin-sig-ed25519:<base64(64-byte-Ed25519-signature)>