# Verify a Konsensus Ink release

Every installer ships with a SHA-256 checksum and a PGP signature. The key is the Konsensus Release Signing key, held by Page for Niko Laamanen, at development@konsensus.net.

Public key: https://konsensus.ink/konsensus-release.asc  
(also at https://konsensus-ink.konsensus-llc.workers.dev/konsensus-release.asc until the apex is live)

Fingerprint (check this before you trust the key):

```
47FA BE82 12E6 B671 02AA D037 FBE5 1AB2 BC05 EB56
```

A release folder contains:

- the installer (`.exe`, `.dmg` or `.apk`)
- a detached signature next to it, same name plus `.asc`
- `SHA256SUMS` — SHA-256 of every installer
- `SHA256SUMS.asc` — the same list, clearsigned

Do these steps on a computer you already trust. Android does not check PGP itself; verify the `.apk` here, then copy it over.

## 1. Import the key and check the fingerprint

Download `konsensus-release.asc` from the address above, or from the Signing key page on konsensus.ink.

**Linux and macOS** (GnuPG is in most Linux distributions; on a Mac, `brew install gnupg`):

```sh
gpg --import konsensus-release.asc
gpg --fingerprint 47FABE8212E6B67102AAD037FBE51AB2BC05EB56
```

**Windows** (install [Gpg4win](https://www.gpg4win.org/), then PowerShell or Kleopatra):

```powershell
gpg --import .\konsensus-release.asc
gpg --fingerprint 47FABE8212E6B67102AAD037FBE51AB2BC05EB56
```

The fingerprint must match the one printed above, character for character. A first import will say the key is not certified — that is expected until you sign it yourself. Trust comes from matching the fingerprint, not from that warning going away.

## 2. Verify the checksums file

`SHA256SUMS.asc` is clearsigned. Decrypt it so GnuPG checks the signature and prints the signed list, then confirm it matches `SHA256SUMS`:

```sh
gpg --output SHA256SUMS.signed --decrypt SHA256SUMS.asc
diff SHA256SUMS SHA256SUMS.signed
```

You want “Good signature” from `Konsensus Release Signing (Page for Niko Laamanen) <development@konsensus.net>`, with the fingerprint above, and no `diff` output. (`gpg --verify SHA256SUMS.asc` also reports a good signature, but if `SHA256SUMS` sits next to it GnuPG warns that the unsigned file was not compared. The decrypt step above does that comparison.)

Then confirm the installers themselves match the list.

**Linux:**

```sh
sha256sum -c SHA256SUMS
```

**macOS:**

```sh
shasum -a 256 -c SHA256SUMS
```

**Windows (PowerShell):**

```powershell
Get-Content SHA256SUMS | ForEach-Object {
  $hash, $file = $_ -split ' +', 2
  $file = $file.Trim()
  $got = (Get-FileHash -Algorithm SHA256 -Path $file).Hash
  if ($got -ieq $hash) { "OK $file" } else { "FAIL $file" }
}
```

## 3. Verify the installer signature

**Linux and macOS:**

```sh
gpg --verify INSTALLER.asc INSTALLER
```

Replace `INSTALLER` with the `.exe`, `.dmg` or `.apk` you downloaded.

**Windows (PowerShell):**

```powershell
gpg --verify .\INSTALLER.asc .\INSTALLER
```

Again you want “Good signature” and the fingerprint above.

You can also hash a single file and compare it to the line in `SHA256SUMS`:

- Linux: `sha256sum INSTALLER`
- macOS: `shasum -a 256 INSTALLER`
- Windows: `Get-FileHash -Algorithm SHA256 .\INSTALLER`

## Android

Verify the `.apk` and its `.asc` on a computer with the Linux, macOS or Windows steps above. Once the signature and hash check out, copy the `.apk` to the phone and install it from storage. If you use Termux, the Linux commands work there too (`pkg install gnupg coreutils`).

## If a check fails

Do not install the file. Write to development@konsensus.net with the filename, the fingerprint you saw, and where you downloaded it.