Cryptographic Release Verification Guide | Snigdha OS Decentralized

Cryptographic Trust

Release Verification Guide

Learn how to prove that your downloaded Snigdha OS Decentralized ISO is byte-for-byte identical to the published release and has not been altered in transit.

Integrity vs. Authenticity: Why Hashes Alone Are Insufficient

A common operational mistake is verifying only a SHA-256 checksum. While a checksum proves data integrity (confirming that no bits were corrupted due to flaky network downloads or bad USB blocks), it does not prove authenticity.

If a malicious actor compromises an untrusted mirror or executes a man-in-the-middle attack, they can easily replace both the ISO and its checksum file. A valid cryptographic signature made by the official Snigdha OS Release Signing Key is the only mathematical proof that the file originated from the authentic development team.

Pinned Release Authority

Official Snigdha OS Release Signing Key

Always confirm that the imported public key corresponds to this exact 4096-bit RSA fingerprint:

UID:Snigdha OS Release Signing (dev) <release-dev@snigdhaos.org>

Key Type:RSA 4096-bit

Fingerprint:

2BDB 00AE 6CAB EF0E 4052 0A8F 553F D42B 02A8 211A

1Import the Official Release Key

Download the ASCII-armored public key and import it into your GnuPG keyring:

GnuPG Key Import

#Download the public key from the official domain
$curl -sO https://decentralized.snigdhaos.org/release/release-signing-key.asc
$
#Import into your keyring
$gpg --import release-signing-key.asc
$
#Verify the fingerprint
$gpg --fingerprint release-dev@snigdhaos.org

2Verify the Detached OpenPGP Signature

Verify the detached signature for the SHA256SUMS manifest or the ISO directly:

GnuPG Signature Verification

#Download SHA256SUMS and its detached signature
$curl -sO https://decentralized.snigdhaos.org/release/SHA256SUMS
$curl -sO https://decentralized.snigdhaos.org/release/SHA256SUMS.sig
$
#Verify the cryptographic signature
$gpg --verify SHA256SUMS.sig SHA256SUMS

Expected output must include: Good signature from "Snigdha OS Release Signing (dev) <release-dev@snigdhaos.org>"

3Validate the ISO Checksum

Compute the SHA-256 hash of your downloaded ISO file and compare it against the verified manifest:

Checksum Verification

$sha256sum --check --ignore-missing SHA256SUMS

Expected output: snigdhaos-decentralize-2026.11.13-x86_64.iso: OK

4Automated Verification via \`snigdha-verify\`

The project provides a standalone Python 3 verification utility that validates signatures, checksums, and UKI Secure Boot PE binaries in a single step:

Standalone Verifier

#Clone the trust tools from repository
$git clone https://gitlab.com/SnigdhaOS/decentralized.git
$cd decentralized/trust/verification
$
#Run standalone verification across all artifacts
$./snigdha-verify /path/to/downloaded/directory

← Return to Downloads Read dm-verity & UKI Architecture →