What changed, and why it matters
This commit only updates user documentation for installing the Krux desktop installer. It removes per-platform instructions for verifying downloaded files and replaces them with a single shared verification page. There is no code change, no firmware change, and no change to how Krux devices validate firmware. The only security-relevant aspect is that the docs still tell users to check file signatures and hashes before installing the desktop app.
No security action required. Review the new verify-download.en.md page for accuracy of the Windows PowerShell hash-check regex and ensure the documented signing key matches the actual release key.
Security signals we found
Documentation still instructs users to verify GPG signatures and SHA256 hashes of the installer
Hardcoded signing key and keyserver moved from snippet into mkdocs.yml template variables
No change to actual signature/integrity verification behavior of the installer or device firmware
Evidence from the diff
A documentation-only refactor in the MkDocs site. It deletes reused snippet files for signature/integrity verification, removes per-OS verification sections, and adds a new verify-download.en.md page that centralizes GPG signature and SHA256 checks for the new installer release manifest. mkdocs.yml gains extra template variables for the new SHA256 manifest filename, signature file, signing key, and keyserver. No executable code, build scripts, cryptographic checks, or firmware verification logic is modified.
Changed components
docs/getting-started/installing/from-gui/*.en.mddocs/getting-started/installing/from-gui/verify-download.en.mddocs/snippets/verify-the-*.en.txtmkdocs.ymlInspect captured patch +72 / −203
diff --git a/docs/getting-started/installing/from-gui/debian-like.en.md b/docs/getting-started/installing/from-gui/debian-like.en.md
index 840beeb..f2e9993 100644
--- a/docs/getting-started/installing/from-gui/debian-like.en.md
+++ b/docs/getting-started/installing/from-gui/debian-like.en.md
@@ -1,33 +1,7 @@
# :material-debian: Download assets
* [`{{latest_installer_deb}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}})
-* [`{{latest_installer_deb}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt)
-* [`{{latest_installer_deb}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sig)
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_deb}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_deb}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
-
## Install
**Krux-Installer** isn't available on Debian or Ubuntu repositories.
diff --git a/docs/getting-started/installing/from-gui/fedora-like.en.md b/docs/getting-started/installing/from-gui/fedora-like.en.md
index 471c6b9..867af3e 100644
--- a/docs/getting-started/installing/from-gui/fedora-like.en.md
+++ b/docs/getting-started/installing/from-gui/fedora-like.en.md
@@ -1,32 +1,6 @@
# :material-fedora: Download assets
* [`{{latest_installer_rpm}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}})
-* [`{{latest_installer_rpm}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}}.sha256.txt)
-* [`{{latest_installer_rpm}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_rpm}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_rpm}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/getting-started/installing/from-gui/index.en.md b/docs/getting-started/installing/from-gui/index.en.md
index 1cede1f..bfcb671 100644
--- a/docs/getting-started/installing/from-gui/index.en.md
+++ b/docs/getting-started/installing/from-gui/index.en.md
@@ -5,6 +5,7 @@ official desktop application, **Krux-Installer**:
Install instructions:
+- [:material-fingerprint: Don't trust, verify](./verify-download.en.md)
- [:material-microsoft-windows: Windows](./windows.md)
- [:material-apple: MacOS Intel](./macos-intel.md)
- [:material-apple: MacOS M1/M2/M3](./macos-arm64.md)
@@ -13,4 +14,4 @@ Install instructions:
- [:material-linux: Other linux distros](./other-linux-distro.md)
> ⚠️ If you find any bug, please submit a
-[issue here](https://github.com/selfcustody/krux-installer/issues).
\ No newline at end of file
+[issue here](https://github.com/selfcustody/krux-installer/issues).
diff --git a/docs/getting-started/installing/from-gui/macos-arm64.en.md b/docs/getting-started/installing/from-gui/macos-arm64.en.md
index 2214ad0..26e67ef 100644
--- a/docs/getting-started/installing/from-gui/macos-arm64.en.md
+++ b/docs/getting-started/installing/from-gui/macos-arm64.en.md
@@ -1,32 +1,6 @@
# :material-apple: Download assets
* [`{{latest_installer_mac_arm}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}})
-* [`{{latest_installer_mac_arm}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}}.sha256.txt)
-* [`{{latest_installer_mac_arm}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_mac_arm}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_mac_arm}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/getting-started/installing/from-gui/macos-intel.en.md b/docs/getting-started/installing/from-gui/macos-intel.en.md
index 98644de..4b731f1 100644
--- a/docs/getting-started/installing/from-gui/macos-intel.en.md
+++ b/docs/getting-started/installing/from-gui/macos-intel.en.md
@@ -1,32 +1,6 @@
# :material-apple: Download assets
* [`{{latest_installer_mac_intel}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_intel}})
-* [`{{latest_installer_mac_intel}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_intel}}.sha256.txt)
-* [`{{latest_installer_mac_intel}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_intel}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_mac_intel}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_mac_intel}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/getting-started/installing/from-gui/other-linux-distro.en.md b/docs/getting-started/installing/from-gui/other-linux-distro.en.md
index e9d4fec..ea57713 100644
--- a/docs/getting-started/installing/from-gui/other-linux-distro.en.md
+++ b/docs/getting-started/installing/from-gui/other-linux-distro.en.md
@@ -3,33 +3,7 @@
For this installation, we'll use the `.deb` sources:
* [`{{latest_installer_deb}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}})
-* [`{{latest_installer_deb}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt)
-* [`{{latest_installer_deb}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_deb}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_deb}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
-
+
## Install
This step it's not really an installation.
@@ -61,4 +35,4 @@ The binary will be located at `./usr/local/bin/krux-installer`.
----8<----
after-install-installer.en.txt
-----8<----
\ No newline at end of file
+----8<----
diff --git a/docs/getting-started/installing/from-gui/verify-download.en.md b/docs/getting-started/installing/from-gui/verify-download.en.md
new file mode 100644
index 0000000..e361645
--- /dev/null
+++ b/docs/getting-started/installing/from-gui/verify-download.en.md
@@ -0,0 +1,64 @@
+Before start using the GUI, it's **strongly recommended** to verify the authenticity of the [{{latest_installer_sha}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_sha}}.txt) file.
+It attest the integrity of all variants ([{{latest_installer_deb}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}), [{{latest_installer_rpm}}]((https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}})), [{{latest_installer_mac_arm}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}}), [{{latest_installer_win}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}})).
+
+To do this, download two files:
+
+* [`{{latest_installer_sha}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt);
+* [`{{latest_installer_sha}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sig).
+
+## Verify the authenticity
+
+**Linux/MacOS**
+
+The next step is import the developer's key:
+
+```bash
+gpg --keyserver {{latest_installer_keyserver}} --recv-keys {{latest_installer_key}}
+```
+
+Then, to verify yourself, run this:
+
+```bash
+gpg --verify {{latest_installer_sha}}.txt.sig
+```
+
+**Windows**
+
+* You'll need have [GPG](https://gnupg.org/) installed;
+* We recommend installing [GPG4Win](https://www.gpg4win.org/).
+
+After install, you can proceed with **Linux/MacOS** steps in the terminal.
+
+> ⚠️ TIP: If the verification was successful, you may get a message similar to: `Good signature from "qlrddev <qlrddev@gmail.com>"`.
+Also, you can ignore a WARNING message if it says that the key isn't a trusted one (you need to do it manually).
+
+## Verify the integrity
+
+After verify that the [`{{latest_installer_sha}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt)
+is authentic, we can proceed with the integrity check in your `bash`/`zsh` terminal:
+
+**Linux / MacOS**
+
+```bash
+sha256sum --check {{latest_installer_sha}}.txt
+```
+
+**Windows**
+
+You can verify the integrity with this command in a `powershell` terminal:
+
+```pwsh
+(Get-FileHash '.\{{latest_installer_win}}' -Algorithm SHA256).Hash -ieq (
+ (Select-String '.\{{latest_installer_sha}}' -Pattern (
+ '^\s*([0-9a-f]{64})\s+' + [regex]::Escape((Split-Path '.\{{latest_installer_win}}' -Leaf)) + '$'
+ ) | Select-Object -First 1
+ ).Matches[0].Groups[1].Value
+)
+```
+
+> 🛡️ TIP: If you followed the authenticity/integrity checks steps presented, you already
+have the assurance that the software is from a verified and genuine software publisher.
+This will also help establish a chain of trust when you perform the firmware verification
+step before flashing.
+
+
diff --git a/docs/getting-started/installing/from-gui/windows.en.md b/docs/getting-started/installing/from-gui/windows.en.md
index 40f6876..6f895fc 100644
--- a/docs/getting-started/installing/from-gui/windows.en.md
+++ b/docs/getting-started/installing/from-gui/windows.en.md
@@ -1,62 +1,6 @@
# :material-microsoft-windows: Download assets
* [`{{latest_installer_win}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}})
-* [`{{latest_installer_win}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}}.sha256.txt)
-* [`{{latest_installer_win}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```pwsh
-(Get-FileHash '.\{{latest_installer_win}}').Hash.ToLower() -eq (Get-Content '.\{{latest_installer_win}}.sha256.txt').split(" ")[0]
-```
-
-The result in prompt should be `True`.
-
-Alternatively, you can check more closely in two steps:
-
-* Compute the binary sha256sum hash:
-
-```pwsh
-# Option 1: Compute in default way
-Get-FileHash '.\{{latest_installer_win}}'
-
-# Option 2: Compute and filter the necessary information
-(Get-FileHash '.\{{latest_installer_win}}').Hash
-
-# Option 3: Compute, filter and process the Hash for lowercase letters
-(Get-FileHash '.\{{latest_installer_win}}').Hash.ToLower()
-```
-
-* Compare with provided hash:
-
-```pwsh
-# Option 1: Get content
-Get-Content '.\{{latest_installer_win}}.sha256.txt'
-
-# Option 2: Get content and filter the necessary information
-(Get-Content '.\{{latest_installer_win}}.sha256.txt').split(" ")[0]
-```
-
-## Verify the authenticity
-
-* You'll need have [GPG](https://gnupg.org/) installed;
-* We recommend installing [GPG4Win](https://www.gpg4win.org/).
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```pwsh
-gpg --verify ./{{latest_installer_win}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/snippets/verify-the-integrity-explain.en.txt b/docs/snippets/verify-the-integrity-explain.en.txt
deleted file mode 100644
index a283a75..0000000
--- a/docs/snippets/verify-the-integrity-explain.en.txt
+++ /dev/null
@@ -1 +0,0 @@
-Open your terminal and type the command below:
diff --git a/docs/snippets/verify-the-signature-explain.en.txt b/docs/snippets/verify-the-signature-explain.en.txt
deleted file mode 100644
index de4cebf..0000000
--- a/docs/snippets/verify-the-signature-explain.en.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-The first step is import the developer's key:
-
-```bash
-gpg --keyserver hkps://keys.openpgp.org --recv-keys B4281DDDFBBD207BFA4113138974C90299326322
-```
-
-Then, to verify yourself, run this command on your terminal:
diff --git a/docs/snippets/verify-the-signature-tip.en.txt b/docs/snippets/verify-the-signature-tip.en.txt
deleted file mode 100644
index 6e1f4fb..0000000
--- a/docs/snippets/verify-the-signature-tip.en.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-> ⚠️ TIP: If the verification was successful,
-> you may get a message similar to: `Good signature from "qlrddev <qlrddev@gmail.com>"`
diff --git a/docs/snippets/verify-the-signature-trust-tip.en.txt b/docs/snippets/verify-the-signature-trust-tip.en.txt
deleted file mode 100644
index c20ad40..0000000
--- a/docs/snippets/verify-the-signature-trust-tip.en.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-> 🛡️ TIP: If you followed the steps presented in [authenticity section](#verify-the-authenticity),
-you already have the assurance that the software is from a verified and genuine software publisher.
-This will also help establish a chain of trust when you perform the firmware verification
-step before flashing.
diff --git a/mkdocs.yml b/mkdocs.yml
index 51575a7..f7c6841 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -59,6 +59,10 @@ extra:
latest_installer_win: krux-installer_v0.0.20.Setup.exe
latest_installer_mac_arm: krux-installer_0.0.20_arm64.dmg
latest_installer_mac_intel: krux-installer_0.0.20_x86_64.dmg
+ latest_installer_sha: krux-installer.SHA256.txt
+ latest_installer_sig: krux_installer.SHA256.txt.sig
+ latest_installer_key: B4281DDDFBBD207BFA4113138974C90299326322
+ latest_installer_keyserver: hkps://keys.openpgp.org
social:
- icon: fontawesome/solid/bullhorn
link: https://bitcointalk.org/index.php?topic=5489022.0
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.