Verify your download

Vardoger hasn’t launched yet, so there are no downloads to verify today. This page describes the verification workflow you’ll use once releases are live.

Vardoger releases are signed with a GPG key dedicated to the project. You can verify any artifact you download from get.vardoger.app against this key before running it. We strongly encourage doing so for the curl | sh installation path.

If you install via the APT repository (Debian / Ubuntu) or via signed .rpm (Fedora / RHEL), apt and dnf verify the signatures automatically — you don't need to do anything extra. The steps below are for the install.sh curl-pipe path and for power users who want to manually inspect signatures.

Signing key

The fingerprint above is the canonical identifier for the project's signing key. After importing the public key, compare what gpg --fingerprint shows on your machine to the value here. If they don't match exactly, stop and contact us — do not run any artifact signed by that key.

The public key is also published at the dedicated vardoger-trust GitHub repository (a second independent origin) and on the keys.openpgp.org keyserver. Cross-checking the fingerprint across origins makes silent key substitution much harder for an attacker.

One-time setup

Import the public key into your GPG keyring:

curl -O https://vardoger.app/vardoger-release.pub.asc
gpg --import vardoger-release.pub.asc
gpg --fingerprint signing@vardoger.app

Compare the fingerprint output to the one in the table above. They must match exactly.

Verify before each install

curl -O https://get.vardoger.app/install.sh
curl -O https://get.vardoger.app/install.sh.asc
gpg --verify install.sh.asc install.sh

You should see output containing:

gpg: Good signature from "Vardoger Signing <signing@vardoger.app>"

Only after seeing that message should you run the installer:

sudo sh install.sh

Power-user one-liner

This fetches, verifies, and installs in a single pipeline that fails closed if the signature is bad:

curl -fsSL https://get.vardoger.app/install.sh > /tmp/v.sh && \
  curl -fsSL https://get.vardoger.app/install.sh.asc | gpg --verify - /tmp/v.sh && \
  sudo sh /tmp/v.sh

If gpg --verify exits non-zero, the && chain stops and the installer is never run.

Alternative: SHA-256 cross-origin check (no GPG required)

If you don't have GPG installed or don't want to import a key, you can verify any release artifact (install.sh, .deb, or .rpm) using its SHA-256 hash, as long as you cross-check against more than one origin so a compromise of any single publishing host doesn't go undetected.

Current artifact hashes for 0.1.26:

The same hashes are published at three independent origins as a sha256sum-compatible SHA256SUMS file:

• Cloudflare Pages (this site): https://vardoger.app/SHA256SUMS
• R2 distribution endpoint: https://get.vardoger.app/SHA256SUMS
• GitHub-served (different vendor): https://raw.githubusercontent.com/ctfish/vardoger-trust/main/SHA256SUMS

To verify:

# Download what you want to verify (any of these)
curl -O https://get.vardoger.app/install.sh
curl -O https://get.vardoger.app/vardoger_0.1.26-1_amd64.deb

# Fetch the manifest from THREE origins
curl -fsSL https://vardoger.app/SHA256SUMS                                                   -o SHA256SUMS.pages
curl -fsSL https://get.vardoger.app/SHA256SUMS                                               -o SHA256SUMS.r2
curl -fsSL https://raw.githubusercontent.com/ctfish/vardoger-trust/main/SHA256SUMS           -o SHA256SUMS.github

# Cross-origin agreement check — all three must be byte-identical
diff SHA256SUMS.pages SHA256SUMS.r2
diff SHA256SUMS.r2 SHA256SUMS.github
# (no output means all origins agree; any difference is suspicious — stop)

# Verify your downloaded artifacts against the agreed manifest
sha256sum -c SHA256SUMS.pages --ignore-missing
# Expected: install.sh: OK, vardoger_0.1.26-1_amd64.deb: OK, etc. for each file you downloaded

The SHA-256 values change whenever the artifacts are updated. The GPG signature path remains the recommended primary verification because it transitively trusts a single hardware-token-resident key rather than requiring you to fetch a new hash for every release. The cross-origin SHA-256 check is the no-GPG fallback and a defense-in-depth alongside GPG.

What if verification fails?

If gpg --verify reports BAD signature, the install.sh you downloaded does not match the signature. Possible causes, in order of likelihood:

1. The download was truncated or corrupted — retry the curl command.
2. You imported a wrong or outdated public key — re-import from the source above and re-check the fingerprint.
3. The artifact has been tampered with — do not run it. Report at the contact below.

Never run an installer whose signature did not verify. Even if you trust the source, run the installer from a known-good origin instead.

What if the key is rotated or revoked?

If we ever rotate the signing key (planned or in response to a compromise), we will:

1. Publish the new key's fingerprint on this page and at get.vardoger.app/vardoger-release.pub.asc.
2. Publish a revocation certificate for the old key to keys.openpgp.org and on this site.
3. Sign the announcement with both the old and new keys (during the transition window).

If you imported the old key, gpg --refresh-keys will pick up the revocation from keys.openpgp.org. After a rotation, re-import the new public key from the URL above.

Contact

Suspected key compromise or signature problem: please email security@vardoger.app.