Verifying releases¶

Every enconf release is built reproducibly and published with signed checksums, so you can independently prove a package is built exactly from the published source — "do not trust, verify".

Optional

Not needed for normal use: apt already verifies packages via the signed enconf repository. These steps are for anyone who additionally wants to check the artifacts themselves.

1. Import the signing key (once)¶

curl -fsSL https://get.enconf.com/enconf-release-pubkey.asc | gpg --import

Fingerprint to compare: 464389AC D5D0FD35 0232DD4A 3960F63A C6C8BE58

2. Fetch checksums + signature¶

V=<version>   # e.g. the version from »apt-cache policy enconf-webpanel«
curl -fsSLO "https://get.enconf.com/checksums/SHA256SUMS-$V"
curl -fsSLO "https://get.enconf.com/checksums/SHA256SUMS-$V.asc"

3. Verify the signature¶

gpg --verify "SHA256SUMS-$V.asc" "SHA256SUMS-$V"
# → Good signature from "enconf Release Signing <releases@netcell-it.de>"

4. Match the package against the checksum¶

sha256sum enconf-webpanel_${V}_amd64.deb
# must exactly match the line in SHA256SUMS-$V

Rebuild reproducibly (optional)¶

The build is deterministic (-trimpath, fixed timestamps). Rebuilding from the same git state yields byte-identical .deb files (same sha256):

git checkout "v$V"
./packaging/build.sh
sha256sum dist/*_"$V"_*.deb