Verify a release signature by hand

🚧 Coming with signed releases (PolarInstall, phase I2). There are no signed release files yet: today PolarBot is installed by building it from source (Install (manual)). This page describes the planned format so you know what to expect; the exact commands will be filled in when the first signed release is published.

What a release will look like

• A release is a manifest (manifest.json) listing every file with its version, platform, size and SHA-256 hash, plus a signature of that manifest (manifest.json.minisig).
• The signature is made with an ed25519 key in minisign format. The private key is kept offline on the maintainer’s desktop: never on the download server and never in CI.
• The public key will be published on this page, in the repository and compiled into PolarInstall, so you can compare all three.
• Files are offered from downloads.polarsystems.net and from GitHub Releases. Both carry the same signed manifest, so it does not matter which one you use: a download that does not match the signed hash is not the release.
• Third-party downloads the installer needs (Paper, Java, SteamCMD, the Stormworks server) are pinned by version and SHA-256 in the same manifest, never “latest”.

Checking by hand (outline)

1. Install minisign (Debian/Ubuntu: sudo apt install minisign; Fedora: sudo dnf install minisign).
2. Download manifest.json, manifest.json.minisig and the files you want.
3. Check the signature against the published public key: minisign -Vm manifest.json -P <public key>. Only continue on Signature and comment signature verified.
4. Check each file’s hash against the manifest: sha256sum <file> must print exactly the sha256 the manifest lists for it.

Anything that fails a check must not be run. The installer will do exactly these checks before it executes anything.