Verifying a Release

Cryptographic signature validation and SHA-256 checksum checks.

1 min readUpdated: 2026-11-12

# Verifying a Release

Never boot an operating system image without verifying both its integrity (checksum) and authenticity (cryptographic digital signature).

# 1. Pinned Signing Key Fingerprint

The official release signing key for Snigdha OS Decentralized is:

Key Identity:  Snigdha OS Release Signing <release@snigdhaos.org>
Key Type:      RSA 4096-bit
Fingerprint:   2BDB 00AE 6CAB EF0E 4052  0A8F 553F D42B 02A8 211A

Warning

Never trust a public key downloaded solely from the same web page or mirror as the ISO without confirming this fingerprint through independent out-of-band channels.

# 2. Verification Steps

# Step 1: Import the Public Key

gpg --import release-signing-key.asc
gpg --fingerprint release@snigdhaos.org

Verify that the output matches 2BDB 00AE 6CAB EF0E 4052 0A8F 553F D42B 02A8 211A.

# Step 2: Verify SHA-256 Hashes

# Verify the signature of SHA256SUMS
gpg --verify SHA256SUMS.sig SHA256SUMS

# Verify the ISO image against the signed manifest
sha256sum --check --ignore-missing SHA256SUMS