In-Browser Binary Verifier & Cryptographic Ledger
Verify the authentic SHA-256 hash, Minisign Ed25519 signature, and SLSA Level 3 build provenance of any downloaded SIAR package. Calculated locally in your browser with zero file uploads.
Drag & Drop any downloaded SIAR file here
Supports .apk, .deb, .rpm, .tar.gz, .AppImage, .dmg, .msix, .exe
SLSA Level 3 in-toto Statement & Rekor Ledger
Every release binary is bound to an immutable build definition, recording the exact Git commit, isolated container environment, and ephemeral OIDC certificate.
{
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "siar-desktop_0.1.0_amd64.deb",
"digest": { "sha256": "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b" }
}
],
"predicateType": "https://slsa.dev/provenance/v1",
"predicate": {
"buildDefinition": {
"buildType": "https://actions.github.io/buildtypes/workflow/v1",
"externalParameters": {
"workflow": {
"ref": "refs/tags/v0.1.0",
"repository": "https://github.com/irshadali5/siar",
"path": ".github/workflows/release.yml"
}
}
},
"runDetails": {
"builder": { "id": "https://github.com/actions/runner" }
}
}
}Offline & Terminal Verification Guide
For air-gapped workstations, terminal operators, and automated deployment scripts.
# 1. Download binary and detached Minisign signature
curl -LO https://pkg.siar.irshad.org.in/releases/siar-cli-v0.1.0-x86_64-unknown-linux-musl.tar.gz
curl -LO https://pkg.siar.irshad.org.in/releases/siar-cli-v0.1.0-x86_64-unknown-linux-musl.tar.gz.minisig
# 2. Verify with SIAR Official Public Release Key
minisign -Vm siar-cli-v0.1.0-x86_64-unknown-linux-musl.tar.gz \
-P RWS1A5v7D1lQ0s8nQj21kX8yN2Zp9qW4eR6tY8uI0oP=Official Public Keys & Fingerprints
Official signing identities and hardware key specifications.
SIAR Root Release Key
RWS1A5v7D1lQ0s8nQj21kX8yN2Zp9qW4eR6tY8uI0oP=
Debian / Ubuntu APT Keyring
Fingerprint: 4F82 1B09 7E65 D34A 9812 BC7E 51A2 8C9D 0F4B 2277
Fedora / RHEL RPM Key
Fingerprint: 8F3A 42C1 B990 E51D 642C FA30 17D5 7B66 448A 2F10