Verifying Signatures

No signed releases yet. OpenVireo has not published a release or its release signing key yet. This page will list the key fingerprint once the first release is out. Until then, there is nothing to verify, and any file claiming to be a signed OpenVireo release is not from us.

By verifying the signatures of OpenVireo releases, you can prove the authenticity and integrity of the downloaded file: it was created by the OpenVireo project and its contents haven't been tampered with on the way.

A more detailed explanation is available in the Qubes-OS project documentation.

Note: OpenVireo releases are signed with OpenVireo's own key, not with the KeePassXC release key. A KeePassXC signature on a file means it is a KeePassXC release, not an OpenVireo one.

Download Options

OpenVireo releases are published on GitHub Releases in these package formats:

a *.dmg drag-and-drop installer for macOS
an *.msi installer and a *.zip archive with binaries for Windows
a self-contained executable *.AppImage for GNU/Linux
a *.tar.xz source tarball

Each of these package files has two related sidecar files, a *.sig containing a PGP signature and a *.DIGEST containing the SHA-256 hash for basic integrity checks.

Verifying Releases – Windows and macOS

Signed Windows installers and notarized macOS apps are checked by the operating system when you run them. You can also verify any package, on any platform, with its PGP signature as described below.

Verifying Releases via PGP – Linux, macOS, and Windows

The *.sig sidecar file contains an OpenPGP (GPG) signature created with the OpenVireo release key.

Step 1: Import the public key

On Windows and macOS you will need to install the gpg program. On Windows, we recommend Gpg4win. On macOS we recommend GPG Tools or gnupg installed via Homebrew.

The OpenVireo release key fingerprint will be published here with the first release.

Step 2: Verify the PGP signature

Once you have imported the key, verify the authenticity and integrity of a downloaded package from its detached signature:

1$ gpg --verify OpenVireo-*.sig

You want to see a "Good signature" line, and the primary key fingerprint in the output must match the OpenVireo release key fingerprint published on this page. If the verification fails or the fingerprint does not match, do NOT install the package. First, try downloading it again. If the checks are still failing, let us know by opening an issue.

gpg may warn that the key is "not certified with a trusted signature" if you have not marked the key as trusted. It can be ignored if (and only if) the fingerprint is correct.

Basic Integrity Check

You can also perform a simple integrity check of the file using the .DIGEST sidecar file. This will ONLY tell you that the file has been downloaded correctly without errors. It will NOT tell you if you can TRUST the download!

Linux and macOS

Open a terminal window and change directory to the folder you downloaded the files to, e.g. cd ~/Downloads, then run:

1$ shasum -a 256 -c OpenVireo-*.DIGEST
2OpenVireo-*: OK

Windows

Open a PowerShell window, change directory to the folder you downloaded the files to, e.g. cd C:\Users\username\Downloads, and run:

1(Get-FileHash .\OpenVireo-*-Win64.msi).Hash -eq (Get-Content .\OpenVireo-*-Win64.msi.DIGEST).split(" ")[0].ToUpper()

You should see True appear. If not, then the download is invalid or your files are not together.