Verify locally · Trent Power
Author: Trent Power
Description: Detached verification notes: signed manifest check from a temporary keyring

Skip to content

Verify Locally

# Get tothe terminal!

Detached verification notes for the signed integrity manifest. Run the check in a temporary keyring so the public signing key does not enter your default keychain.

    tmpdir="$(mktemp -d)"
    export GNUPGHOME="$tmpdir"

    ts=$(date +%s)
    curl -fsS "https://trentpower.fr/integrity.json?ts=$ts" -o integrity.json
    curl -fsS "https://trentpower.fr/integrity.json.sig?ts=$ts" -o integrity.json.sig
    curl -fsS "https://trentpower.fr/.well-known/pgp-key.asc?ts=$ts" | gpg --import
    gpg --verify integrity.json.sig integrity.json

    rm -rf "$tmpdir" integrity.json integrity.json.sig

The command imports the public key into a throw-away keyring, verifies the signed manifest, and removes the working files. No state is retained on the machine afterwards.

01 Temporary keyring

Use a temp GNUPGHOME so the import does not touch your main keyring.

02 Import public key

curl /.well-known/pgp-key.asc · gpg --import pgp-key.asc.

03 Verify signature

gpg --verify integrity.json.sig integrity.json - expect Good signature.

04 Check manifest

/integrity.json lists every public file with its SHA-256.

05 Compare checksums

Re-hash any file and compare against the manifest entry.

06 Reproducibility notes

Each signed edition is frozen in /integrity/releases/. No mutable assets.

Under Construction