Signed release checksums.

Pin this release key

OpenSSH Ed25519 · first published September 13, 2026.

SHA256:rn5J0wzL/7dY5OdKiSz+J2+nu0INP1ShjIb+cB7uZh0

Public signing key · Allowed signer policy

Confirm the fingerprint through a channel you already trust, then retain your own copy. Downloading a key beside a package does not independently establish trust on the first visit. Do not silently accept a changed key.

Identity and signature namespace: releases@xbtpulse.tech. A valid signature establishes possession of the pinned key, not code safety or truthful telemetry.

Download the verification files

Existing ZIP bytes are unchanged. The older adapter README inside its ZIP predates these detached signatures; this is the current verification guidance.

Verify on Linux

Save the ZIP, checksum, signature, public key and allowed-signers file in one folder. Check the key fingerprint against your trusted copy first:

ssh-keygen -lf release-signing-key.pub

Build the signer policy from the public key whose fingerprint you just verified (do not trust a separate downloaded policy without checking it):

printf 'releases@xbtpulse.tech namespaces="releases@xbtpulse.tech" %s\n' "$(cat release-signing-key.pub)" > allowed_signers

For the DATUM collector, verify the checksum signature:

ssh-keygen -Y verify -f allowed_signers \
  -I releases@xbtpulse.tech -n releases@xbtpulse.tech \
  -s SHA256SUMS.txt.sig < SHA256SUMS.txt

Only after signature verification succeeds, verify the downloaded archive:

sha256sum -c SHA256SUMS.txt

For the adapter kit, substitute ADAPTER-SHA256SUMS.txt and ADAPTER-SHA256SUMS.txt.sig. Stop on any failure.

Full instructions, building your signer policy & key rotation ↗ · Pinned-key verification script ↗

Use OpenSSH with ssh-keygen -Y support. These are OpenSSH signatures, not GPG .asc files.