Verify a download | Sophia Stack X

Every release has one list, latest.json, that names each file and its SHA-256. SOPHIA XT signs that list with an Ed25519 key. Check the signature once, then check any file against the list. If both match, the file is the one we published.

The release key is:

1d6b0c095ceca8b2e6ca84c4cc11413fc6906fb5384b9e703ed98e2a98cd0a22

It is built into every copy of the program and into install.sh. The same key, in the form openssl reads, is at /download/release-key.pem.

On Linux, before running the installer

You need openssl 3.0 or newer (openssl version).

B=https://sophiastack.sophiaxt.com/download
curl -fsSLO $B/install.sh -O $B/latest.json -O $B/latest.json.sig.bin -O $B/release-key.pem

# 1. The list is signed by SOPHIA XT. Prints "Signature Verified Successfully".
openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin -in latest.json -sigfile latest.json.sig.bin

# 2. The script matches the list. The two hashes must be the same.
sha256sum install.sh
grep -A1 '"install.sh"' latest.json

# 3. Read it, then run it.
less install.sh
sudo sh install.sh --domain example.com --tls-email you@example.com

Compare the key inside release-key.pem with the key above if you got the file from the same place as the download. install.sh then repeats the same checks for the program it downloads.

Checking a program

Do steps 1 and 2 with the program's file name in place of install.sh:

sha256sum sophia-linux-x86_64
grep -A1 '"sophia-linux-x86_64"' latest.json

On a Mac, use shasum -a 256 in place of sha256sum. The openssl that ships with macOS can't check Ed25519 signatures; check the signature on any machine with openssl 3, then compare hashes on the Mac.

On Windows, in PowerShell:

Get-FileHash sophia-windows-x86_64.exe -Algorithm SHA256

Compare the result with the entry in latest.json.

What the signature does and doesn't cover

A good signature means the list came from whoever holds the SOPHIA XT release key, and the matching hash means the file is the one on that list. It does not mean an outside party has audited the code. The open-source parts are listed in THIRD-PARTY-NOTICES.txt.

Updates use the same check: sophia update --latest refuses any list that is not signed by the key built into the program, and any program that does not match the list.