DPIBreak

Verifying releases

Every release ships a sha256sum.txt listing the SHA-256 of each asset, and a detached OpenPGP signature sha256sum.txt.sig.

First, fetch the signing key:

curl -O https://dilluti0n.com/pubkey.asc
gpg --import pubkey.asc

Or from a keyserver:

gpg --keyserver hkps://keys.openpgp.org \
    --recv-keys 3D4686CAC75A49A69E49692099A8DC6DA49AB13C

Check the fingerprint:

gpg --fingerprint 3D4686CAC75A49A69E49692099A8DC6DA49AB13C

Output should say something like this:

pub   rsa4096 2025-08-17 [SC]
      3D46 86CA C75A 49A6 9E49  6920 99A8 DC6D A49A B13C
uid           [ultimate] Hee-Suk Kim <[email protected]>

Now, verify signature with it:

gpg --verify sha256sum.txt.sig sha256sum.txt

And check the tarball matches with hash:

sha256sum --ignore-missing -c sha256sum.txt

tarball and sha256sum.txt shall be in same directory.

Source trees

Release tags are signed with the same key:

git verify-tag vX.Y.Z