Verifying a Download

Every file published here ships with a SHA-256 checksum and a GPG signature, signed with one key.

Import the key once. It covers every download on this site: Public key.

gpg --import cordelia-signing-key.asc

Then run both from the folder holding the downloaded file, substituting its name:

sha256sum -c FILE.sha256
gpg --verify FILE.asc FILE

What a successful check looks like

sha256sum -c prints one line ending in OK. gpg --verify prints several lines, and on a first run they look like this. GPG may print them in your own language, and the contact address inside the key's name is left out here:

gpg: Signature made Thu 17 Sep 2026 08:50:48 AM PDT
gpg:                using RSA key 96C905387D861330DF0ABF596F856B529AC60669
gpg: Good signature from "Venhola Consulting Release Signing" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: CEF6 8070 0501 5D06 CEBD  6160 3B59 6D62 DBC6 0119
     Subkey fingerprint: 96C9 0538 7D86 1330 DF0A  BF59 6F85 6B52 9AC6 0669

That warning does not mean the check failed. Good signature is the result that matters: the file was signed by this key and has not changed since. The warning only says you have not certified the key by signing it yourself, which most people never do. A real failure reads BAD signature instead.

The signing key

One key signs everything published here. Confirm that the key you imported is that key, rather than trusting whatever a file arrived with:

gpg --fingerprint CEF6807005015D06CEBD61603B596D62DBC60119

The fingerprint is CEF6 8070 0501 5D06 CEBD 6160 3B59 6D62 DBC6 0119, RSA 4096, signing subkey 6F856B529AC60669, the same key named in the Primary key fingerprint line above. A key that does not match this fingerprint is not this project's, whatever name it carries.

Why both

A checksum rules out a damaged transfer. It does not prove where the file came from. Anyone can publish a matching checksum for a file they altered. The signature is what establishes that.

See also