Release verification

Verify a KinetiShift release.

Prove a KinetiShift release genuinely came from KinetiStack and hasn't been modified — using only openssl and sha256sum. No cosign, minisign, or gpg required on either side.

The model

Two files travel with every release.

SHA256SUMS

The SHA-256 of every artifact — the pilot binary, the provenance record, the attestation, and any container image tar in the bundle.

SHA256SUMS.sig

An Ed25519 detached signature over SHA256SUMS, made with KinetiStack's release signing key.

Verifying the signature proves authenticity (KinetiStack signed it); re-checking the sums proves integrity (nothing was altered). Both must pass — a failed signature means do not trust the artifacts.

Trust anchor

The public release key.

Download the public key, then check its fingerprint over a channel other than the download — so a swapped key is caught.

Download RELEASE-SIGNING-KEY.pem Ed25519 public key · safe to publish

Release key SHA-256 fingerprint

63a432e2ea0d7b82c90a808f5a3aa2c9a1d779fe6a479e524e050c5aaa669257

Reproduce it from the downloaded key:

openssl pkey -pubin -in RELEASE-SIGNING-KEY.pem -outform DER | sha256sum

Verify before you run

Two ways to check a release.

A release directory

With the bundled helper script:

scripts/verify_release.sh <release_dir>

Or with nothing but openssl:

openssl pkeyutl -verify -pubin -inkey RELEASE-SIGNING-KEY.pem \
  -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
sha256sum -c SHA256SUMS

A container image

The image is signed by digest with the same key. Verify it, then pin that exact @sha256: digest — never a mutable tag:

scripts/verify_image.sh "registry/kinetishift@sha256:<digest>" \
  RELEASE-SIGNING-KEY.pem IMAGE-DIGEST.sig

Each pilot release ships its own SHA256SUMS / SHA256SUMS.sig (and, for container images, the digest and IMAGE-DIGEST.sig) alongside the artifacts. The public key above verifies all of them. KinetiShift pilot builds are pre-release evaluation software.

KinetiShift overview Become a founding partner