Skip to content

Verifying downloads

Every release on the releases page comes with two extra files:

  • SHA256SUMS: the SHA-256 checksum of every file in the release.
  • SHA256SUMS.asc: an OpenPGP signature of SHA256SUMS, made with the Slipstream release key.

When the signature is good and your file's checksum is in SHA256SUMS, the file is exactly what we published. Anyone can change a file on a mirror or in transit, but nobody can forge the signature without our key.

The release key
Key file slipstream-release.asc
Fingerprint C28F DB4A 40AA 8360 D8DF 0470 AD8E 6152 6C06 E929
Also on keys.openpgp.org, keyserver.ubuntu.com

Check the fingerprint after you import the key. It must match the one above character for character. The same key signs the apt repository, the Arch PKGBUILD source, and the Flatpak repository.

Linux

# once: import the key and check its fingerprint
curl -fsSL https://slipstreamviewer.org/slipstream-release.asc | gpg --import
gpg --fingerprint 'Slipstream Release Signing Key'

# for each download: put SHA256SUMS and SHA256SUMS.asc next to the file, then
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS

gpg --verify must say Good signature from "Slipstream Release Signing Key". The warning This key is not certified with a trusted signature is normal, because you have not signed our key yourself. That is why you check the fingerprint. sha256sum -c must print OK for your file. --ignore-missing skips the files you didn't download.

The apt repository and the Arch PKGBUILD check signatures automatically, so you don't need to do anything extra there.

Windows

The Windows installer isn't Authenticode-signed yet. You can still check the checksum in PowerShell and compare it with the line for your file in SHA256SUMS:

Get-FileHash .\Slipstream_<version>_Setup.exe -Algorithm SHA256

To check the signature of SHA256SUMS itself, use Gpg4win (gpg --verify SHA256SUMS.asc SHA256SUMS, as on Linux).

If something doesn't match

Don't run the file. Download it again from the releases page. If it still fails, report it.