GhostWire — downloads

Verify a download yourself

Every release directory publishes three trust files alongside the artifact: SHA256SUMS (the hash of every file in the release), SHA256SUMS.sig.json (an Ed25519 signature over the raw bytes of SHA256SUMS), and release-signing-key.pub.json (the public key — safe to publish; the private key never leaves the signer's machine).

1. Check the artifact you downloaded matches the manifest:

shasum -a 256 "<downloaded file>"
grep "<downloaded file>" SHA256SUMS   # hash must match

2. Check SHA256SUMS itself was signed by the release key (needs only openssl + xxd, both standard on macOS/Linux — download the script or run it inline):

PUBHEX=$(grep -o '"public_key_hex"[^,}]*' release-signing-key.pub.json | sed -E 's/.*"([0-9a-f]+)"/\1/')
SIGHEX=$(grep -o '"signature_hex"[^,}]*'   SHA256SUMS.sig.json         | sed -E 's/.*"([0-9a-f]+)"/\1/')
echo -n "302a300506032b6570032100${PUBHEX}" | xxd -r -p > pub.der
xxd -r -p <<< "$SIGHEX" > sig.bin
openssl pkey -pubin -inform DER -in pub.der -outform PEM -out pub.pem
openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in SHA256SUMS -sigfile sig.bin
# -> "Signature Verified Successfully" means the manifest is authentic

If both checks pass, the file you have is byte-for-byte what the release key signed off on — independent of anything your OS says about the publisher.