Digitally Signed Releases

All our releases are digitally signed using a GPG key to ensure authenticity and integrity. You can verify that the files you download have not been tampered with by checking the signature against our public key.

The public key has ID: A31F5ED57BD4386068186B4640D0B4DE7E47274F

Valsight_GmbH_Releases_-_Level_1.pub

To verify a signature:

# Import the public key into the local key store
gpg --import Valsight_GmbH_Releases_-_Level_1.pub

# Verify the signature, replace X.X.X with version number
gpg --verify valsight-server.sig valsight-server-X.X.X.zip

Info:

You must not re-import the Public Key each time you download a new release. In fact, for improved security, it is recommended to verify the correctness of the public key via a seperate channel (Email, Phone) once and then keep the local, trusted version.