Inrupt signs every release of Inrupt Enterprise Solid Server (ESS) software that we distribute through Git. Each release is a Git tag, and each tag carries a signature made with the key below. Before you install or upgrade, check that a release's tag is signed with this key. That shows the release came from Inrupt and was not changed after we published it.
This page is the reference for our signing key. Our installation documentation asks you to compare the key you save with the fingerprint on this page. If the two don't match, don't use the release.
SHA256:Ov56OjnIOQ41+6SY9CSPvZDgzeIZBgWXqdv8M5B7U7Assh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJromXETlTOFhEnWyZ6WGOn1UoOVnN+ve1uqYaSeBCmS1. Save the key in a file that Git can use. This is the line our installation documentation gives you:
printf '%s\n' 'releases@inrupt.com namespaces="git" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJromXETlTOFhEnWyZ6WGOn1UoOVnN+ve1uqYaSeBCmS' > "${HOME}/.ssh/inrupt_allowed_signers"2. Show the fingerprint of the key that you saved:
ssh-keygen -lf "${HOME}/.ssh/inrupt_allowed_signers"The SHA256 value it prints must be exactly the fingerprint above.
3. In your copy of the release repository, check the tag of the release that you are installing (replace <TAG> with the release tag, such as v3.0.0):
git -c gpg.ssh.allowedSignersFile="${HOME}/.ssh/inrupt_allowed_signers" verify-tag <TAG> A genuine release prints: Good "git" signature for releases@inrupt.com with ED25519 key SHA256:Ov56OjnIOQ41+6SY9CSPvZDgzeIZBgWXqdv8M5B7U7A
If we replace this key, we will publish the new key on this page before we use it, along with the date it takes effect. The old key will move to the list below, so that you can still check older releases.
security@inrupt.com
