Add instructions for release signature verification
What the developer wrote
Authored by Keeqler
Add instructions for release signature verification
What changed, and why it matters
This commit only adds documentation to the README explaining how users can verify that downloaded release files are genuine using GPG signatures. It does not change any code, build process, or signing keys, and it does not fix or introduce any security vulnerability.
No action required; this is a benign documentation improvement. Optionally review the published signing key distribution and fingerprint out-of-band for consistency with project security practices.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is a documentation-only change to README.md. It instructs users to import the project’s GPG signing key, check its fingerprint, download release artifacts plus their detached .asc signatures, and run gpg –verify. There are no code modifications, no key material embedded in the repository, and no changes to release workflows.
Changed components
README.mdInspect captured patch +38 / −0
diff --git a/README.md b/README.md
index 073c81f..e7ce708 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,44 @@ Download from [latest release](https://github.com/MAGICGrants/skylight-wallet/re
Download from [latest release](https://github.com/MAGICGrants/skylight-wallet/releases/latest) the ``.exe`` file.
+### Verify release signatures
+
+Each release artifact has a detached GPG signature (``.asc``). Verify downloads before installing. This applies to all signed files (``.deb``, ``.AppImage``, ``.exe``, ``.apk``, ``.aab``, etc.).
+
+**1. Import the signing key** (one-time):
+
+```bash
+curl -LO https://magicgrants.org/files/app-signing-key.asc
+gpg --import app-signing-key.asc
+```
+
+Confirm the fingerprint matches:
+
+```
+65C4 1CFC AE37 B3B2 72AC 40BE A555 F5F7 B1FF 5885
+```
+
+```bash
+gpg --fingerprint '65C4 1CFC AE37 B3B2 72AC 40BE A555 F5F7 B1FF 5885'
+```
+
+The key owner should be `MAGIC Grants <info@magicgrants.org>`.
+
+**2. Download the artifact and its signature** from the release page. Example for v1.0.10 on amd64:
+
+```bash
+curl -LO https://github.com/MAGICGrants/skylight-wallet/releases/download/v1.0.10/skylight-wallet-v1.0.10-amd64.deb
+curl -LO https://github.com/MAGICGrants/skylight-wallet/releases/download/v1.0.10/skylight-wallet-v1.0.10-amd64.deb.asc
+```
+
+**3. Verify the signature**:
+
+```bash
+gpg --verify skylight-wallet-v1.0.10-amd64.deb.asc skylight-wallet-v1.0.10-amd64.deb
+```
+
+A successful verification prints `Good signature from "MAGIC Grants <info@magicgrants.org>"`. Substitute the artifact and ``.asc`` filenames for other platforms (e.g. ``.AppImage``, ``.exe``, ``.apk``).
+
## Prerequisites
Before you begin, ensure you have the following installed:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.