Check a download
This page shows how to check, by hand, that a .deb or an archive from the release page is the file that was released. Packages that you install with apt need no check: apt verifies them with the key of the registry.
Do this first
Section titled “Do this first”Put the file, SHA256SUMS and SHA256SUMS.asc from the same release in one folder. SHA256SUMS lists the archives and the .deb files of the release. SHA256SUMS.asc is its signature, made with a key that only signs releases.
You need gpg and a tool for SHA-256 sums. The commands below are for Linux and macOS, and step 4 has a line for Windows.
1. Import the key
Section titled “1. Import the key”The public key is RELEASE-KEY.asc in the repository.
curl -fsSLO https://codeberg.org/squidd/Tilde/raw/branch/main/RELEASE-KEY.ascgpg --import RELEASE-KEY.asc2. Compare the fingerprint
Section titled “2. Compare the fingerprint”gpg --fingerprint 4C26F8B053103FD18BD144847C1034F0B3541CAAThe fingerprint of the key is:
4C26 F8B0 5310 3FD1 8BD1 4484 7C10 34F0 B354 1CAAThe key expires on 2028-10-29. The name that gpg prints next to the key can differ from the name of Tilde: only the fingerprint counts.
3. Check the signature
Section titled “3. Check the signature”gpg --verify SHA256SUMS.asc SHA256SUMSTwo things count: the line Good signature, and the line Primary key fingerprint with the fingerprint above. gpg also warns that the key is not certified and that nothing says the signature belongs to its owner. That warning is normal: it stays until you mark the key as trusted.
If gpg says BAD signature, or the fingerprint is another one, stop. Do not use the files.
4. Check the file
Section titled “4. Check the file”On Linux:
sha256sum --ignore-missing -c SHA256SUMSOn macOS:
shasum -a 256 --ignore-missing -c SHA256SUMSOn Windows, in PowerShell, print the hash of the file and compare it by eye with the line of that file in SHA256SUMS:
Get-FileHash <file> -Algorithm SHA256The tool prints <file>: OK for each file that you downloaded. --ignore-missing skips the files of the release that are not in the folder. A line with FAILED means that the file differs from the one that was signed: download it again.
What is not signed
Section titled “What is not signed”The nightly builds have a SHA256SUMS and no SHA256SUMS.asc. Their files cannot be checked this way.
Next: install the archive or the .deb with sudo apt install ./<file>.deb. A .deb that you install by hand is not updated by apt.