Verifying releases

Every ledvar release binary is published with two companion files:

Only the second one is a security control. A checksum on its own protects against nothing hostile: whoever can swap the binary can swap the checksum sitting next to it. A signature can’t be forged without the private key — and that key never leaves the maintainer’s machine, never touches CI.

The signing key

750F 73CA 0EC5 9FB3 D945  CA12 911C CB7A 80D3 49FB

Maykon Luiz Matos Araújo <maykon.lma@gmail.com> · Ed25519 · created 2026-07-12

Download it here: ledvar-public-key.asc

The same key is also published in the protocol repository. They must match. Publishing the fingerprint in two independent places is the whole safeguard: an attacker who controls one of them still can’t make the two agree.

Verify a download

# 1. import the key — once
gpg --import ledvar-public-key.asc

# 2. confirm it is the RIGHT key — compare with the fingerprint above
gpg --fingerprint 911CCB7A80D349FB

# 3. verify the release you downloaded
gpg --verify ledvar-v0.1.0-x86_64-unknown-linux-musl.tar.gz.asc \
             ledvar-v0.1.0-x86_64-unknown-linux-musl.tar.gz

A good result looks like this:

gpg: Good signature from "Maykon Luiz Matos Araújo <maykon.lma@gmail.com>"

Do not skip step 2. A valid signature only means something once you know the key belongs to the project. Otherwise an attacker simply hands you a malicious binary together with a key that signs it flawlessly — and every check passes. The fingerprint is the anchor; everything else hangs off it.

You may also see WARNING: This key is not certified with a trusted signature. That is normal and not a failure — it only means you haven’t personally marked the key as trusted in your own keyring. The fingerprint check is what settles it.

What is signed

• Release artifacts — every .tar.gz / .zip on the ledvar-rs releases page.
• Release tags — the git tag itself carries a signature.

Signatures are detached: the .asc sits beside the file and the binary itself is untouched, so you can verify a download without altering it.

Published releases are also immutable — once a release is live, its binaries can never be replaced, not even by the maintainer. Signing proves who made it; immutability proves it hasn’t changed since. A fix means a new version, never an edit to an old one.

If the key is ever compromised

A revocation certificate exists for exactly that. If it is ever used, the key is published in its revoked form and gpg --verify will report This key has been revoked — and this page will say so. Past releases stay verifiable and frozen; only new signatures would be in question.