Palomar Sentry documentation Română

Verifying a downloaded release

Every published release comes with its component list (SBOM), with the file SHA256SUMS — the cryptographic fingerprint (hash) of each installer — and with its detached signature, made with the release key K1. Anyone can verify an installer without the app and without Palomar: with the public key from the downloads page and with OpenSSL 3.

The release key

The downloads page publishes, under “Keys”, the public key K1 with its fingerprint and the backup key K1-backup, which signs the statements about keys. Save the public key K1 as a file and compare its fingerprint with the one shown; a revoked or retired key is listed there as no longer trusted, and the app refuses any release signed with it.

The steps

The exact commands are on the downloads page, under “Verify”; the steps are these.

  1. Check that openssl version prints OpenSSL 3.
  2. Download the release’s files together with SHA256SUMS and SHA256SUMS.sig into the same folder.
  3. Save the public key K1 from “Keys” as k1.pub.pem and compare its fingerprint with the one shown there.
  4. Verify the signature of SHA256SUMS with the public key; OpenSSL prints “Signature Verified Successfully”.
  5. Check each downloaded file against SHA256SUMS: shasum on macOS, sha256sum on Linux.

LibreSSL on macOS

On macOS, the openssl that ships with the system is LibreSSL, which lacks the signature-verification command used in step 4. Install OpenSSL 3 — through Homebrew, for example — and use that one; the first step, openssl version, tells you which one runs.