How we verify downloads

Zyvra's builds are not signed with an Apple or Microsoft certificate. Instead, every release is signed with Zyvra's own key, and you can check that signature yourself in a minute. This page explains how.

What is signed

Each release publishes two small files and their signatures: latest.json (the release manifest, which lists every archive with its SHA-256) and SHA256SUMS.txt (the same hashes, as a plain list). A signature on the manifest therefore covers every download in the release.

The program itself carries the matching public key. zyvra update refuses any release that this key did not sign, checks the archive's hash against the signed manifest, and runs the new program once before it replaces the old one. It never installs an older version and never updates without asking.

The release key

Ed25519 public key (base64):

SHA-256 fingerprint of the key:

The same key is built into every zyvra program and into install.sh. If this page and your program ever disagree, do not install.

Check a download

With zyvra

If you already have Zyvra, it can check any release file against its .sig file in the same folder:

zyvra verify SHA256SUMS.txt
shasum -a 256 -c SHA256SUMS.txt --ignore-missing

The first command checks the signature, the second checks that your archive matches a signed hash. On Windows, use Get-FileHash -Algorithm SHA256 zyvra-v0.3.0-darwin-amd64.tar.gz and compare it with the list.

With OpenSSL 3 (no Zyvra needed)

cat > release-key.pem <<'EOF'
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAmwnnIbrQNSlAdROYjXL0aWFNR+CruiXgJGoX3KYD/H8=
-----END PUBLIC KEY-----
EOF
openssl base64 -d -A -in SHA256SUMS.txt.sig -out sig.bin
openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin -in SHA256SUMS.txt -sigfile sig.bin

It prints Signature Verified Successfully. macOS's built-in OpenSSL is too old for this; Homebrew's openssl@3 works.

Where the files are

• The archives, checksums and signatures are on the releases page.
• This site also serves latest.json and latest.json.sig, so the update check does not depend on one host. A copy is only as trusted as its signature, so it cannot serve anything Zyvra did not sign.

The install command

The install command downloads install.sh (or install.ps1), which fetches the manifest, checks the signature when OpenSSL 3 is available, checks the archive's SHA-256, and installs for your user only. You can read the script before running it: install.sh, install.ps1.