# Snigdha OS Decentralized — Official Release Verification Guide

This guide provides step-by-step instructions for users, system administrators, and independent security auditors to verify the integrity and authenticity of Snigdha OS Decentralized release artifacts.

# 1. Release Artifact Directory Layout

Every published release includes the following artifacts in the release directory:

release/
├── snigdhaos-decentralize-2026.11.13-x86_64.iso          # Bootable live hybrid ISO image
├── snigdhaos-decentralize-2026.11.13-x86_64.iso.sig      # OpenPGP detached signature for ISO
├── SHA256SUMS                                          # SHA-256 checksums manifest
├── SHA256SUMS.sig                                      # OpenPGP detached signature for SHA256SUMS
├── BLAKE2SUMS                                          # BLAKE2b checksums manifest
├── BLAKE2SUMS.sig                                      # OpenPGP detached signature for BLAKE2SUMS
├── release-manifest.json                               # Machine-readable release metadata (Schema v2)
├── release-manifest.json.sig                           # OpenPGP detached signature for manifest
├── SBOM.spdx.json                                      # Software Bill of Materials (SPDX 2.3)
├── SBOM.spdx.json.sig                                  # OpenPGP detached signature for SBOM
├── provenance.intoto.jsonl                             # SLSA v1.0 build provenance attestation
├── provenance.intoto.jsonl.sig                         # OpenPGP detached signature for provenance
├── release-signing-key.asc                             # Distribution OpenPGP public key
└── release-key.fpr                                     # Fingerprint confirmation file

# 2. Pinned Signing Key Fingerprint

Before verifying signatures, confirm that you are using the authentic Snigdha OS Release Signing Key:

Key Identity:  Snigdha OS Release Signing (dev) <release-dev@snigdhaos.org>
Key Type:      RSA 4096-bit
Fingerprint:   2BDB 00AE 6CAB EF0E 4052  0A8F 553F D42B 02A8 211A

# 3. Automated Verification via snigdha-verify

Snigdha OS provides an independent, standalone verification utility: snigdha-verify. It requires only Python 3 and standard cryptographic tools (gpg, veritysetup, sbverify), and can run on any modern Linux distribution.

# Verify the Entire Release Directory

snigdha-verify release /path/to/downloaded/release/

Expected Output:

=================================================================
       Snigdha OS Decentralized - Comprehensive Release Verification
       Directory: /path/to/downloaded/release/
=================================================================
  [PASS] Manifest Signature: SHA256SUMS -> Valid signature by 2BDB00AE6CABEF0E40520A8F553FD42B02A8211A
  [PASS] Verified 4 file(s) against SHA256SUMS
  [PASS] Manifest Signature: BLAKE2SUMS -> Valid signature by 2BDB00AE6CABEF0E40520A8F553FD42B02A8211A
  [PASS] Verified 4 file(s) against BLAKE2SUMS
  [PASS] Manifest Detached Signature: Valid signature by 2BDB00AE6CABEF0E40520A8F553FD42B02A8211A
  [PASS] Schema Version: 2
  [PASS] Distribution: Snigdha OS Decentralized (2026.11.13 - x86_64)
  [PASS] Artifact Count: 1
  [PASS] Boot Framework: dm-verity + UEFI Secure Boot UKI
  [PASS] Release Key Fingerprint: 2BDB00AE6CABEF0E40520A8F553FD42B02A8211A
  [PASS] SPDX Version: SPDX-2.3
  [PASS] Document Name: Snigdha OS Decentralized Software Bill of Materials
  [PASS] Package Count: 581
  [PASS] In-toto Statement: https://in-toto.io/Statement/v1
  [PASS] SLSA Predicate: https://slsa.dev/provenance/v1
=================================================================
VERDICT: PASS - Complete release directory passed all cryptographic and supply chain checks.
=================================================================

# 4. Manual Verification using Standard Command-Line Tools

If you prefer verifying manually using standard utilities:

# Step 1: Import and Verify the Public Key

gpg --import release-signing-key.asc
gpg --fingerprint release-dev@snigdhaos.org

Verify that the output matches: 2BDB 00AE 6CAB EF0E 4052 0A8F 553F D42B 02A8 211A.

# Step 2: Verify Checksum Manifests

gpg --verify SHA256SUMS.sig SHA256SUMS
gpg --verify BLAKE2SUMS.sig BLAKE2SUMS

# Step 3: Verify ISO Checksums

sha256sum --check SHA256SUMS
b2sum --check BLAKE2SUMS

# Step 4: Verify the ISO Detached Signature Directly

gpg --verify snigdhaos-decentralize-2026.11.13-x86_64.iso.sig snigdhaos-decentralize-2026.11.13-x86_64.iso

# 5. UKI Authenticode & dm-verity Verification

For deep auditing of boot artifacts before deployment:

# Verify UKI Authenticode Signature

# Verify the UKI executable against the Snigdha Secure Boot certificate
snigdha-verify uki snigdha-uki.efi --cert snigdha-secureboot-db.crt

# Verify dm-verity Hash Tree

# Verify root image against the authenticated Merkle root hash
snigdha-verify verity airootfs.erofs <ROOT_HASH> --hash-dev airootfs.verity --salt <SALT>