Release keys
Every webx release comes with a .tar.gz.sig file, signed with the key
below. Compare its fingerprint with the one in our email: two channels that agree are what make
the key trustworthy.
The release key
Fingerprint
SHA256:rcjbG/KjSFU/LF2A9SfkU36dcdKtTj2C5stWQXBG+/M
Put this line in a file named allowed_signers:
releases@webx namespaces="webx-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4oKg7KYfyHK7W81tIGL3xZOPKdqW1PmGpt9XAATj6+ releases@webxThen check a release. Use the name of the file you got:
f=webx-v0.110.0-1a2b3c4d5e6f.tar.gz ssh-keygen -Y verify -f allowed_signers -I releases@webx -n webx-release -s "$f.sig" < "$f"
The output starts with Good "webx-release" signature. If it does not, do not
install the release, and tell us. Give the same file to the installer with
--signers allowed_signers, and it checks every later update too.
The license key
Licenses from this site are signed with a separate key, which can sign licenses only. webx carries it; you need nothing for it.
Fingerprint
SHA256:FZotTnqWrLWBl5xiadwo+sbm+EQby8TEXouQoq2SQzo