Verifying downloads and packages
One OpenPGP key signs the APT repository and the checksums of every installer image. Check its fingerprint once, and everything else follows from it.
The signing key
| Key | Fingerprint |
|---|---|
| Primary, certification only | 4E9D 50F1 21DE 93A7 F3B4 F2A1 B4D0 7D35 371C 6320 |
| Signing subkey | FC40 68FA CAFE 7D4D F840 5E2A A15A C615 2E6D 877F |
Both are Ed25519 keys belonging to cmnSense APT repository <apt@cmnsense.org>. The primary key is kept offline and only certifies the signing subkey, which does the day-to-day signing. The key is published at https://apt.cmnsense.org/cmnsense-archive-keyring.pgp and in the cmnsense-archive-keyring package.
shell
curl -fsSLO https://apt.cmnsense.org/cmnsense-archive-keyring.pgp gpg --show-keys --with-subkey-fingerprints cmnsense-archive-keyring.pgp
Checking an installer image
Each release directory holds SHA256SUMS, listing every image, and SHA256SUMS.sign, its detached signature. Check the signature first, then the image you downloaded:
shell
gpgv --keyring ./cmnsense-archive-keyring.pgp SHA256SUMS.sign SHA256SUMS sha256sum --ignore-missing -c SHA256SUMS
gpgv must report a good signature made by the signing subkey above, and sha256sum must print OK for your image. On macOS, use shasum -a 256 --ignore-missing -c SHA256SUMS.
The installer images are built from the official Debian netinst images, whose own checksums are checked against Debian's CD signing key during the build.
The APT repository
apt checks every package list against the key named in the repository's Signed-By field and refuses anything else. The repository's Release files also name the primary key, so even a valid signature from another key in your keyring is rejected. Packages are only ever published to the trixie suite after they have been tested from a separate staging suite.