Verify Linux downloads

Archil publishes a signed SHA-256 checksum manifest for every signed Linux release. Use it to verify a downloaded DEB, RPM, or musl binary before installing or running it. This procedure verifies that an artifact matches the release signed by Archil. It does not replace your normal review of the release version.

Normal install or manual verification?

For a normal installation, use the convenience installer:

curl -fsSL https://archil.com/install | sh

The convenience installer is the standard installation path. If you want to verify a versioned artifact before executing it, follow the manual OpenPGP signature and checksum procedure below.

What you need

curl
gpg (GnuPG)
sha256sum (supplied by GNU coreutils or BusyBox)

The commands below use a temporary GnuPG keyring and do not change your normal GnuPG configuration.

Trust Archil’s release signing key

Archil’s production Linux release signing-subkey fingerprint is:

075082A64956DDB6281A08A827A9B35E790F664A

Before trusting a downloaded certificate, confirm that its fingerprint matches the value above. This documentation page is independent from the S3 release bucket.

Archil Linux release public certificate

The following is Archil’s public release certificate. Confirm that its fingerprint matches the value above before using it to verify a release.

Choose a release and artifact

Choose the exact version and filename you intend to install. Signed Linux artifacts and their verification metadata are published under https://s3.amazonaws.com/archil-client/pkg/. To select the version currently used by the production install channel, read its latest pointer:

curl --fail --location https://s3.amazonaws.com/archil-client/pkg/latest

The latest pointer is mutable and is not authenticated. Use it only to choose a version to download; the signature and checksum steps below verify the artifact. For a reproducible installation, record an explicit version instead of relying on latest. For example, if the release includes archil_0.8.21-123_amd64.deb, use 0.8.21-123 as VERSION:

VERSION="0.8.21-123"
BASE_URL="https://s3.amazonaws.com/archil-client/pkg"
ARTIFACT="archil_${VERSION}_amd64.deb"

Use the exact filename listed in the release. The common artifact names are:

Platform	Artifact name
Debian/Ubuntu AMD64	`archil_<version>_amd64.deb`
Debian/Ubuntu ARM64	`archil_<version>_arm64.deb`
RPM AMD64	`archil-<rpm-version>.x86_64.rpm`
RPM ARM64	`archil-<rpm-version>.aarch64.rpm`
musl AMD64	`archil-linux-musl-amd64-<version>`
musl ARM64	`archil-linux-musl-arm64-<version>`

For RPMs, use the exact filename from the release. Pre-release versions can have a different RPM-safe version string.

Download the artifact and verification files

Create a clean working directory and download the package, checksum manifest, detached signature, and public certificate for the same version:

mkdir "archil-verify-${VERSION}"
cd "archil-verify-${VERSION}"

curl --fail-early --fail --location --remote-name-all \
  "$BASE_URL/$ARTIFACT" \
  "$BASE_URL/archil_${VERSION}_SHA256SUMS" \
  "$BASE_URL/archil_${VERSION}_SHA256SUMS.sig" \
  "$BASE_URL/archil_${VERSION}_linux_release_signing_key.asc"

Each signed release includes these verification files:

File	Purpose
`archil_<version>_SHA256SUMS`	SHA-256 checksums for the six Linux artifacts.
`archil_<version>_SHA256SUMS.sig`	ASCII-armored detached OpenPGP signature for the checksum manifest.
`archil_<version>_linux_release_signing_key.asc`	Public certificate for the Linux release signing key.

If any download fails, stop. In particular, we recommend not to install an artifact when its checksum manifest, signature, or certificate is unavailable. We suggest not to mix files from different versions or release channels. If the verification files for a release are unavailable, contact support@archil.com.

Verify the public key and checksum signature

Import the downloaded certificate into a temporary keyring. The first check confirms that the certificate contains Archil’s expected signing-subkey fingerprint; the second confirms that this exact key signed the checksum manifest.

EXPECTED_FINGERPRINT="075082A64956DDB6281A08A827A9B35E790F664A"

export GNUPGHOME="$(mktemp -d)"
trap 'rm -rf "$GNUPGHOME"' EXIT
chmod 700 "$GNUPGHOME"

gpg --batch --import "archil_${VERSION}_linux_release_signing_key.asc"

if ! gpg --batch --with-colons --fingerprint --list-keys \
  | awk -F: -v expected="$EXPECTED_FINGERPRINT" \
    '$1 == "fpr" && toupper($10) == toupper(expected) { found = 1 } END { exit !found }'; then
  echo "The downloaded certificate does not contain Archil's expected signing fingerprint." >&2
  exit 1
fi

if ! gpg --batch --status-fd 1 --verify \
  "archil_${VERSION}_SHA256SUMS.sig" \
  "archil_${VERSION}_SHA256SUMS" 2>/dev/null \
  | awk -v expected="$EXPECTED_FINGERPRINT" \
    '$1 == "[GNUPG:]" && $2 == "VALIDSIG" && toupper($3) == toupper(expected) { found = 1 } END { exit !found }'; then
  echo "The checksum manifest did not pass Archil's expected signature validation. We recommend not installing the artifact." >&2
  exit 1
fi

If either check fails, we advise not to install or run the artifact. Delete the downloaded files and obtain them again only from the canonical release location.

Verify the downloaded artifact

Extract the one expected checksum entry, then verify your downloaded artifact against it:

if ! CHECKSUM_LINE="$(awk -v artifact="$ARTIFACT" \
  '$2 == artifact { count++; line = $0 } END { if (count != 1) exit 1; print line }' \
  "archil_${VERSION}_SHA256SUMS")"; then
  echo "Expected exactly one checksum entry for $ARTIFACT." >&2
  exit 1
fi

if ! printf '%s\n' "$CHECKSUM_LINE" | sha256sum -c -; then
  echo "Checksum verification failed. Do not install or run $ARTIFACT." >&2
  exit 1
fi

The command must print:

<artifact name>: OK

If it prints FAILED, reports that the artifact is missing from the manifest, or produces no OK line, we recommend not installing or running the file.

Install after verification

Run only the command applicable to your verified artifact:

# Debian/Ubuntu
sudo apt install ./$ARTIFACT

# RPM-based distributions
sudo dnf install ./$ARTIFACT

# musl binary, for example Alpine
sudo install -m 0755 "$ARTIFACT" /usr/local/bin/archil

Clean up

Remove the temporary keyring when you are finished:

rm -rf "$GNUPGHOME"
unset GNUPGHOME EXPECTED_FINGERPRINT

Key rotation and security notices

Before a planned signing-key rotation, Archil will publish the replacement fingerprint and retain the prior fingerprint during a documented overlap. If you suspect a signing key has been compromised, we advise not to install new artifacts until Archil publishes a security notice and replacement verification instructions through its documentation. Report suspected security issues to security@archil.com.

Scope

This page covers versioned, signed Linux releases only. It does not cover macOS, Windows, package-repository signing, Sigstore or Cosign attestations, or the unversioned https://archil.com/install script.

Getting started

Mounting

Compute

Concepts

Data Sources

Details

Administration

Protocols

SDKs

Integrations

Reference

Legal

Verify Linux downloads

Normal install or manual verification?

What you need

Trust Archil’s release signing key

Archil Linux release public certificate

Choose a release and artifact

Download the artifact and verification files

Verify the public key and checksum signature

Verify the downloaded artifact

Install after verification

Clean up

Key rotation and security notices

Scope

​Normal install or manual verification?

​What you need

​Trust Archil’s release signing key

​Archil Linux release public certificate

​Choose a release and artifact

​Download the artifact and verification files

​Verify the public key and checksum signature

​Verify the downloaded artifact

​Install after verification

​Clean up

​Key rotation and security notices

​Scope

Normal install or manual verification?

What you need

Trust Archil’s release signing key

Archil Linux release public certificate

Choose a release and artifact

Download the artifact and verification files

Verify the public key and checksum signature

Verify the downloaded artifact

Install after verification

Clean up

Key rotation and security notices

Scope