What changed, and why it matters
This commit only updates user documentation for the Krux installer. It removes per-platform verification instructions and replaces them with a single new page explaining how to verify the installer's authenticity and integrity. No source code, build scripts, or cryptographic checks in the project itself were changed.
No security action required. Review the new verification page for accuracy if desired, but treat this as a routine documentation reorganization.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is entirely within Markdown documentation and the MkDocs configuration. It deletes shared snippet files for signature/integrity verification and removes duplicated verification sections from each OS-specific install page. A new verify-download.en.md page centralizes the GPG and SHA256 verification steps, and mkdocs.yml adds template variables for the new SHA256 manifest and signing key. There are no code, dependency, CI/CD, or firmware changes.
Changed components
docs/getting-started/installing/from-gui/*.en.mddocs/snippets/verify-the-*.en.txtmkdocs.ymlInspect captured patch +72 / −203
diff --git a/docs/getting-started/installing/from-gui/debian-like.en.md b/docs/getting-started/installing/from-gui/debian-like.en.md
index 840beeb..f2e9993 100644
--- a/docs/getting-started/installing/from-gui/debian-like.en.md
+++ b/docs/getting-started/installing/from-gui/debian-like.en.md
@@ -1,33 +1,7 @@
# :material-debian: Download assets
* [`{{latest_installer_deb}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}})
-* [`{{latest_installer_deb}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt)
-* [`{{latest_installer_deb}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sig)
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_deb}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_deb}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
-
## Install
**Krux-Installer** isn't available on Debian or Ubuntu repositories.
diff --git a/docs/getting-started/installing/from-gui/fedora-like.en.md b/docs/getting-started/installing/from-gui/fedora-like.en.md
index 471c6b9..867af3e 100644
--- a/docs/getting-started/installing/from-gui/fedora-like.en.md
+++ b/docs/getting-started/installing/from-gui/fedora-like.en.md
@@ -1,32 +1,6 @@
# :material-fedora: Download assets
* [`{{latest_installer_rpm}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}})
-* [`{{latest_installer_rpm}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}}.sha256.txt)
-* [`{{latest_installer_rpm}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_rpm}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_rpm}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/getting-started/installing/from-gui/index.en.md b/docs/getting-started/installing/from-gui/index.en.md
index 1cede1f..bfcb671 100644
--- a/docs/getting-started/installing/from-gui/index.en.md
+++ b/docs/getting-started/installing/from-gui/index.en.md
@@ -5,6 +5,7 @@ official desktop application, **Krux-Installer**:
Install instructions:
+- [:material-fingerprint: Don't trust, verify](./verify-download.en.md)
- [:material-microsoft-windows: Windows](./windows.md)
- [:material-apple: MacOS Intel](./macos-intel.md)
- [:material-apple: MacOS M1/M2/M3](./macos-arm64.md)
@@ -13,4 +14,4 @@ Install instructions:
- [:material-linux: Other linux distros](./other-linux-distro.md)
> ⚠️ If you find any bug, please submit a
-[issue here](https://github.com/selfcustody/krux-installer/issues).
\ No newline at end of file
+[issue here](https://github.com/selfcustody/krux-installer/issues).
diff --git a/docs/getting-started/installing/from-gui/macos-arm64.en.md b/docs/getting-started/installing/from-gui/macos-arm64.en.md
index 2214ad0..26e67ef 100644
--- a/docs/getting-started/installing/from-gui/macos-arm64.en.md
+++ b/docs/getting-started/installing/from-gui/macos-arm64.en.md
@@ -1,32 +1,6 @@
# :material-apple: Download assets
* [`{{latest_installer_mac_arm}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}})
-* [`{{latest_installer_mac_arm}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}}.sha256.txt)
-* [`{{latest_installer_mac_arm}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_mac_arm}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_mac_arm}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/getting-started/installing/from-gui/macos-intel.en.md b/docs/getting-started/installing/from-gui/macos-intel.en.md
index 98644de..4b731f1 100644
--- a/docs/getting-started/installing/from-gui/macos-intel.en.md
+++ b/docs/getting-started/installing/from-gui/macos-intel.en.md
@@ -1,32 +1,6 @@
# :material-apple: Download assets
* [`{{latest_installer_mac_intel}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_intel}})
-* [`{{latest_installer_mac_intel}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_intel}}.sha256.txt)
-* [`{{latest_installer_mac_intel}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_intel}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_mac_intel}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_mac_intel}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/getting-started/installing/from-gui/other-linux-distro.en.md b/docs/getting-started/installing/from-gui/other-linux-distro.en.md
index e9d4fec..ea57713 100644
--- a/docs/getting-started/installing/from-gui/other-linux-distro.en.md
+++ b/docs/getting-started/installing/from-gui/other-linux-distro.en.md
@@ -3,33 +3,7 @@
For this installation, we'll use the `.deb` sources:
* [`{{latest_installer_deb}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}})
-* [`{{latest_installer_deb}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt)
-* [`{{latest_installer_deb}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```bash
-sha256sum --check ./{{latest_installer_deb}}.sha256.txt
-```
-
-## Verify the authenticity
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```bash
-gpg --verify ./{{latest_installer_deb}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
-
+
## Install
This step it's not really an installation.
@@ -61,4 +35,4 @@ The binary will be located at `./usr/local/bin/krux-installer`.
----8<----
after-install-installer.en.txt
-----8<----
\ No newline at end of file
+----8<----
diff --git a/docs/getting-started/installing/from-gui/verify-download.en.md b/docs/getting-started/installing/from-gui/verify-download.en.md
new file mode 100644
index 0000000..e361645
--- /dev/null
+++ b/docs/getting-started/installing/from-gui/verify-download.en.md
@@ -0,0 +1,64 @@
+Before start using the GUI, it's **strongly recommended** to verify the authenticity of the [{{latest_installer_sha}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_sha}}.txt) file.
+It attest the integrity of all variants ([{{latest_installer_deb}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}), [{{latest_installer_rpm}}]((https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_rpm}})), [{{latest_installer_mac_arm}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_mac_arm}}), [{{latest_installer_win}}](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}})).
+
+To do this, download two files:
+
+* [`{{latest_installer_sha}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt);
+* [`{{latest_installer_sha}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sig).
+
+## Verify the authenticity
+
+**Linux/MacOS**
+
+The next step is import the developer's key:
+
+```bash
+gpg --keyserver {{latest_installer_keyserver}} --recv-keys {{latest_installer_key}}
+```
+
+Then, to verify yourself, run this:
+
+```bash
+gpg --verify {{latest_installer_sha}}.txt.sig
+```
+
+**Windows**
+
+* You'll need have [GPG](https://gnupg.org/) installed;
+* We recommend installing [GPG4Win](https://www.gpg4win.org/).
+
+After install, you can proceed with **Linux/MacOS** steps in the terminal.
+
+> ⚠️ TIP: If the verification was successful, you may get a message similar to: `Good signature from "qlrddev <qlrddev@gmail.com>"`.
+Also, you can ignore a WARNING message if it says that the key isn't a trusted one (you need to do it manually).
+
+## Verify the integrity
+
+After verify that the [`{{latest_installer_sha}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_deb}}.sha256.txt)
+is authentic, we can proceed with the integrity check in your `bash`/`zsh` terminal:
+
+**Linux / MacOS**
+
+```bash
+sha256sum --check {{latest_installer_sha}}.txt
+```
+
+**Windows**
+
+You can verify the integrity with this command in a `powershell` terminal:
+
+```pwsh
+(Get-FileHash '.\{{latest_installer_win}}' -Algorithm SHA256).Hash -ieq (
+ (Select-String '.\{{latest_installer_sha}}' -Pattern (
+ '^\s*([0-9a-f]{64})\s+' + [regex]::Escape((Split-Path '.\{{latest_installer_win}}' -Leaf)) + '$'
+ ) | Select-Object -First 1
+ ).Matches[0].Groups[1].Value
+)
+```
+
+> 🛡️ TIP: If you followed the authenticity/integrity checks steps presented, you already
+have the assurance that the software is from a verified and genuine software publisher.
+This will also help establish a chain of trust when you perform the firmware verification
+step before flashing.
+
+
diff --git a/docs/getting-started/installing/from-gui/windows.en.md b/docs/getting-started/installing/from-gui/windows.en.md
index 40f6876..6f895fc 100644
--- a/docs/getting-started/installing/from-gui/windows.en.md
+++ b/docs/getting-started/installing/from-gui/windows.en.md
@@ -1,62 +1,6 @@
# :material-microsoft-windows: Download assets
* [`{{latest_installer_win}}`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}})
-* [`{{latest_installer_win}}.sha256.txt`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}}.sha256.txt)
-* [`{{latest_installer_win}}.sig`](https://github.com/selfcustody/krux-installer/releases/download/{{latest_installer}}/{{latest_installer_win}}.sig)
-
-## Verify the integrity
-
-----8<----
-verify-the-integrity-explain.en.txt
-----8<----
-
-```pwsh
-(Get-FileHash '.\{{latest_installer_win}}').Hash.ToLower() -eq (Get-Content '.\{{latest_installer_win}}.sha256.txt').split(" ")[0]
-```
-
-The result in prompt should be `True`.
-
-Alternatively, you can check more closely in two steps:
-
-* Compute the binary sha256sum hash:
-
-```pwsh
-# Option 1: Compute in default way
-Get-FileHash '.\{{latest_installer_win}}'
-
-# Option 2: Compute and filter the necessary information
-(Get-FileHash '.\{{latest_installer_win}}').Hash
-
-# Option 3: Compute, filter and process the Hash for lowercase letters
-(Get-FileHash '.\{{latest_installer_win}}').Hash.ToLower()
-```
-
-* Compare with provided hash:
-
-```pwsh
-# Option 1: Get content
-Get-Content '.\{{latest_installer_win}}.sha256.txt'
-
-# Option 2: Get content and filter the necessary information
-(Get-Content '.\{{latest_installer_win}}.sha256.txt').split(" ")[0]
-```
-
-## Verify the authenticity
-
-* You'll need have [GPG](https://gnupg.org/) installed;
-* We recommend installing [GPG4Win](https://www.gpg4win.org/).
-
-----8<----
-verify-the-signature-explain.en.txt
-----8<----
-
-```pwsh
-gpg --verify ./{{latest_installer_win}}.sig
-```
-
-----8<----
-verify-the-signature-tip.en.txt
-----8<----
## Install
diff --git a/docs/snippets/verify-the-integrity-explain.en.txt b/docs/snippets/verify-the-integrity-explain.en.txt
deleted file mode 100644
index a283a75..0000000
--- a/docs/snippets/verify-the-integrity-explain.en.txt
+++ /dev/null
@@ -1 +0,0 @@
-Open your terminal and type the command below:
diff --git a/docs/snippets/verify-the-signature-explain.en.txt b/docs/snippets/verify-the-signature-explain.en.txt
deleted file mode 100644
index de4cebf..0000000
--- a/docs/snippets/verify-the-signature-explain.en.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-The first step is import the developer's key:
-
-```bash
-gpg --keyserver hkps://keys.openpgp.org --recv-keys B4281DDDFBBD207BFA4113138974C90299326322
-```
-
-Then, to verify yourself, run this command on your terminal:
diff --git a/docs/snippets/verify-the-signature-tip.en.txt b/docs/snippets/verify-the-signature-tip.en.txt
deleted file mode 100644
index 6e1f4fb..0000000
--- a/docs/snippets/verify-the-signature-tip.en.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-> ⚠️ TIP: If the verification was successful,
-> you may get a message similar to: `Good signature from "qlrddev <qlrddev@gmail.com>"`
diff --git a/docs/snippets/verify-the-signature-trust-tip.en.txt b/docs/snippets/verify-the-signature-trust-tip.en.txt
deleted file mode 100644
index c20ad40..0000000
--- a/docs/snippets/verify-the-signature-trust-tip.en.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-> 🛡️ TIP: If you followed the steps presented in [authenticity section](#verify-the-authenticity),
-you already have the assurance that the software is from a verified and genuine software publisher.
-This will also help establish a chain of trust when you perform the firmware verification
-step before flashing.
diff --git a/mkdocs.yml b/mkdocs.yml
index c0a7673..fbd584a 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -59,6 +59,10 @@ extra:
latest_installer_win: krux-installer_v0.0.20.Setup.exe
latest_installer_mac_arm: krux-installer_0.0.20_arm64.dmg
latest_installer_mac_intel: krux-installer_0.0.20_x86_64.dmg
+ latest_installer_sha: krux-installer.SHA256.txt
+ latest_installer_sig: krux_installer.SHA256.txt.sig
+ latest_installer_key: B4281DDDFBBD207BFA4113138974C90299326322
+ latest_installer_keyserver: hkps://keys.openpgp.org
social:
- icon: fontawesome/solid/bullhorn
link: https://bitcointalk.org/index.php?topic=5489022.0
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.