Verifying downloads
All releases are hosted at downloads.zecnero.org. Release files are signed with the project key. The same key signs commits and announcements.
| Key fingerprint | FFFC 8AC0 2BF7 B4B4 50B4 3B1F 6532 09A3 44E7 5767 |
| Public key | zecnero.org/zecnero.asc |
Check the fingerprint from more than one source, for example this page, the project site and a pinned Discord message.
1. Import the key
curl -fsSL https://zecnero.org/zecnero.asc | gpg --import
gpg --fingerprint FFFC8AC02BF7B4B450B43B1F653209A344E75767
The fingerprint printed must match the one above exactly.
2. Check the signature
gpg --verify SHA256SUMS.asc SHA256SUMS
Look for Good signature. A warning that the key is not certified with a trusted signature is normal unless you have signed the key yourself.
3. Check the checksum
Linux:
sha256sum --check --ignore-missing SHA256SUMS
macOS:
shasum -a 256 --check --ignore-missing SHA256SUMS
Windows (PowerShell):
Get-FileHash .\FILE_NAME -Algorithm SHA256
Compare the output with the line for that file in SHA256SUMS.
Confirm the checksum and signature file names published with each release (the commands above assume SHA256SUMS and a detached SHA256SUMS.asc).
Installer scripts
The one-line installers download files from downloads.zecnero.org. To check what they do, download the script and read it before running it. See Read before you pipe.
Confirm whether the installers verify signatures or checksums of the binaries they download.