MUON release signing keys

The manifest key signs the release manifest and signs install.sh with the detached signature install.sh.sig. Public keys below are base64-encoded SPKI DER.

role: release-manifest
keyId: sha256:e63d771f74c661945d3674cf633b8b07d7628536ba9783a958e13b91f341cbb6
publicKey: MCowBQYDK2VwAyEAj38Q783SKDGtQhxTS24pOX2UMgsPipkL1RzlnJHpFxY=

The channel key signs the stable channel pointer, channels/stable.signed.json.

role: release-channel
keyId: sha256:7e0bcc847cd491254dbbf89b3a9cf875c68034198f7c0cf445507a6f9d5363e8
publicKey: MCowBQYDK2VwAyEAVvx9WW+3kZuSJE3vceGIrzkuSFt6JFkNtCHRcG7ivns=

Decode each public key from base64 to DER, then calculate its SHA-256. The resulting hex digest must match the corresponding keyId after the sha256: prefix.

printf '%s' 'MCowBQYDK2VwAyEAj38Q783SKDGtQhxTS24pOX2UMgsPipkL1RzlnJHpFxY=' | openssl base64 -d -A > release-manifest.public.der
shasum -a 256 release-manifest.public.der
printf '%s' 'MCowBQYDK2VwAyEAVvx9WW+3kZuSJE3vceGIrzkuSFt6JFkNtCHRcG7ivns=' | openssl base64 -d -A > release-channel.public.der
shasum -a 256 release-channel.public.der

Convert the checked manifest key to PEM for installer verification:

openssl pkey -pubin -inform DER -in release-manifest.public.der -out release-manifest.public.pem

The installer verifies downloaded artifacts but cannot verify its own first run. Node.js 20.10 or newer is required. Download it without running it:

curl -fsSLO https://getmuon.com/install.sh

Fetch https://download.getmuon.com/releases/<version>/install.sh.sig for the release bulletin's version and save it as install.sh.sig. Match the installer's version and digest to that bulletin. Use the manifest key checked above and a trusted OpenSSL with Ed25519 support:

openssl pkeyutl -verify -pubin -inkey release-manifest.public.pem -rawin -in install.sh -sigfile install.sh.sig

Only after verification succeeds, run bash install.sh.

A key rotation is announced on this page and in the release notes. A key that appears only in one place is not trusted. Do not trust a key only because a download server sends it alongside a file.