Snail OS
Verify a release.
Every firmware image is signed offline before it is published. The signing key is not on this server. Here is the public half, the exact bytes it signs, and the SHA-256 of every image being served — so you can check what you have before you install it.
The key
ECDSA P-256.
The private half was generated offline and has never been on the machine that serves this site, so a person who takes over this host cannot sign an image. Check a download against the public half below and a substituted file fails the check.
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEc/32DnIjIz1ZmnnfGAjG02liU8f0 J2+EiRBJF1wUCD375Oe8tijCd1epOTWY1CdLq/JiZQIuMfA9GfN2IHozFw== -----END PUBLIC KEY-----
What is signed
A manifest you rebuild.
The signature covers five lines assembled from the release's own fields, so a signature cannot be lifted from one release and pasted onto a different file, size or hash. Line feeds, not carriage returns, and a trailing newline after the hash. One byte of disagreement fails the check.
snailos-fw/1 <version> <file> <size> <sha256 lowercase hex>
Published images
0 images on this server.
Hashes are computed at build time from the same files the server sends. Version 1.53 is current.
| Version | Bytes | SHA-256 |
|---|
The signature on 1.53, base64, as it appears in latest.json:
MEQCIAOyRdmLSwCb7oujjklTitull6Gmj/T2UMWTUq8xW5jcAiBvqXemOSvIMEEB8O/SAZUUjW/USYVZ5S/uQ5WN7GGlDQ==
Checking it yourself
Two commands.
The first confirms the bytes match the table above. The second confirms the signature was made by the key above, over the manifest for that exact file, size and hash.
shasum -a 256 snail-os-1.53.bin
# rebuild the signed manifest, byte for byte printf 'snailos-fw/1\n%s\n%s\n%s\n%s\n' \ "$VERSION" "$FILE" "$SIZE" "$SHA256" > manifest.txt # the public key from the top of this page openssl dgst -sha256 -verify snailos-pubkey.pem \ -signature <(base64 -d <<< "$SIG") manifest.txt
A mismatch means the file you have is not the file that was published. Do not install it, and write to joey@snailos.org.