Verify

Two checks answer two questions. The checksum shows that the ISO you downloaded is the file we published. The signature shows that the system image came from Elavo's build.

Check the ISO

Compute the SHA-256 checksum of the file, and compare it with the one on the download page. They must match exactly.

Linux

sha256sum path/to/elavo.iso

macOS

shasum -a 256 path/to/elavo.iso

Windows (PowerShell)

Get-FileHash path\to\elavo.iso -Algorithm SHA256

If the checksums differ, delete the file and download it again. Do not install from it.

Check the system image

Every Elavo image is signed with cosign when it is built. Installed machines update from that image, ghcr.io/elavo-io/elavo. Download the public key, then run:

cosign verify --key cosign.pub ghcr.io/elavo-io/elavo

With no tag, cosign checks latest. To check another tag, add it after a colon, for example ghcr.io/elavo-io/elavo:stable once the stable channel exists.

A good result lists the checks cosign performed and prints the signature as JSON. A failure prints an error and no signature.

The public key

Download it from this site, cosign.pub, and compare it with the copy in the image repository. If they differ, trust neither, and do not install.

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEu/1HskOO1+g4XeC7QLUC1n7mtm7I
F2V9vzI48DxAIjN3iDmsFPd8P//DpRqF9mRg1fnHmdTYeboZyqYGwSXKww==
-----END PUBLIC KEY-----

Getting cosign

On macOS, install it with Homebrew:

brew install cosign

For Linux and Windows, download a build from the cosign releases page.