The chain you need to establish#
- Source
- Build
- Artifact
- Checksum
- Signature & evidence
The reviewed repository does not establish a complete public distribution chain. Do not treat the diagram above as a claim that each link has been qualified.
Compare a file locally#
The optional tool below uses your browser’s SHA-256 implementation. The selected file stays in memory on your device; it is not sent to this website or a server. Only files up to 64 MiB are accepted.
The engineering package has its own verification command#
Where: a trusted workstation, with the project’s package verifier available. Prerequisite: the engineering archive and a separately authenticated expected checksum.
kurdpackage verify --archive <archive>Effect: inspect the archive, rather than install or start the node. Replace <archive> with the intended path.
Success: the verifier exits successfully for the intended package; compare its identity with trusted publication information. Failure: stop and obtain the intended artifact. Do not bypass verification.
This command was checked against the source guide, not executed against a VPN release during this website build.
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.