Verifying Vauz downloads

Every Vauz release is signed with minisign. The signature proves two things: that a release really came from us, and that the file you downloaded is the one we signed.

Vauz public signing key

RWTcejyNskGe1Xc8GvEbKjUlI2wPh8XLVcs8Xcd3EraJvmSX7LuX8QQY

This key does not change between releases. Save it once and reuse it for every future download — a key you already held is worth far more than one you fetch from us at the moment you need it.

How to check a download

Two things need checking, and both matter: that the checksum file really came from us, and that your installer matches it. A valid signature on its own says nothing about the file you actually downloaded.

1. Install minisign

Once only — it is a small command-line tool, not a Vauz component.

macOS

brew install minisign

Windows

winget install jedisct1.minisign

Linux

sudo apt install minisign

On Windows this installs as a portable package, so open a new terminal afterwards or minisign will not be found yet. On Fedora use sudo dnf install minisign, on Arch sudo pacman -S minisign. Debian needs 12 or newer and Ubuntu 24.04 or newer; older releases have no minisign package.

2. Check the signature on the checksum file

Download SHA256SUMS and SHA256SUMS.minisig, and put both in the same folder as your installer.

On Windows, check the name of the first file before you go on. SHA256SUMS has no file extension, and browsers tend to add one, so it often arrives as SHA256SUMS.txt. Both steps below look for the original name. This puts it back, and does nothing at all if your browser left it alone:

Windows (PowerShell)

if (Test-Path SHA256SUMS.txt) { Rename-Item SHA256SUMS.txt SHA256SUMS }

Then, in that folder (same command for all platforms):

minisign -Vm SHA256SUMS -P RWTcejyNskGe1Xc8GvEbKjUlI2wPh8XLVcs8Xcd3EraJvmSX7LuX8QQY

The same command on every platform. Expect Signature and comment signature verified, followed by a trusted comment naming the release version and date. Both files have to sit together — minisign looks for the .minisig beside the file it is checking.

3. Check your installer against the checksums

macOS and Linux have a built-in flag for this, so their commands are one line. Windows has no equivalent, so the PowerShell version writes the same work out in full. Line by line, it takes each entry in SHA256SUMS, separates the expected hash from the filename, hashes that file on your own machine, and prints OK only if the two are identical. It reads your installer and nothing else: nothing is sent anywhere, nothing is changed on disk, and it does not touch your vault. You should never have to paste a command you cannot follow — least of all on a page about not trusting things blindly.

macOS

shasum -a 256 --ignore-missing -c SHA256SUMS

Linux

sha256sum --ignore-missing -c SHA256SUMS

Windows (PowerShell)

Get-Content SHA256SUMS | ForEach-Object {
    $expected, $file = $_ -split '\s+', 2
    if (-not (Test-Path $file)) { $file + ': skipped, not downloaded' }
    elseif ((Get-FileHash $file -Algorithm SHA256).Hash -eq $expected) { $file + ': OK' }
    else { $file + ': FAILED' }
}

All three read the expected hash and the filename out of SHA256SUMS and do the comparing for you, so there is no version number to fill in and no long hex string to check by eye. Each prints the installer's own filename followed by : OK — whatever that file is called on your platform, be it a .dmg, an .exe or a Linux package. Once a release carries more than one installer, the ones you did not download are reported as skipped, which is not a failure. A FAILED line means the file is incomplete or has been altered. Do not open it.

Confirm the key somewhere other than here

A signature only tells you something if you can obtain our key from a source an attacker would have to break into separately. The same key is published as a DNS record, served by our DNS provider rather than by a web server:

macOS and Linux

dig +short TXT _minisign.vauz.sealzi.com

Windows

nslookup -type=TXT _minisign.vauz.sealzi.com

Both return v=minisign1; k=RWTce… — check it matches the key, in the beginning of this page, character for character. On Windows nslookup works in both Command Prompt and PowerShell; PowerShell also has Resolve-DnsName -Type TXT _minisign.vauz.sealzi.com.

What this key is not

It is not an encryption key, and it protects none of your data.
It has nothing to do with your V-Key, and you never enter it anywhere in Vauz.
It is public by design. It is one of a matched pair: the secret key that signs our releases never leaves us, while this one exists to be handed out. Publishing it costs us nothing.

If a check ever fails

Do not open the installer. A failed check means the file is incomplete or has been altered somewhere between us and you. Write to security@vauz.sealzi.com and tell us what you saw — that is something we want to hear about the same day.