Verifying AetherSDR Releases
August 12, 2026 · View on GitHub
Signing Overview
| Platform | Signing Method |
|---|---|
| Linux AppImage | GPG detached signature (.asc) |
| Windows .exe | GPG detached signature (.asc) |
| Windows .zip | GPG detached signature (.asc) |
| Source archive | GPG detached signature (.asc) |
| macOS DMG | Apple codesign + notarization |
| macOS .pkg | Apple codesign + notarization |
Each release also includes a GPG-signed SHA256SUMS.txt covering all
Linux and source artifacts.
GPG Key Fingerprint
B765 6E6B CB2E 022B 79F0 F97B 5578 D10E 3D59 18F3
Import the Public Key
From the repository:
curl -sSL https://raw.githubusercontent.com/aethersdr/AetherSDR/main/docs/RELEASE-SIGNING-KEY.pub.asc | gpg --import
Or from keys.openpgp.org:
gpg --keyserver keys.openpgp.org --recv-keys <KEY_ID>
Verify a Linux Download
Option 1: Verify the artifact directly
gpg --verify AetherSDR-v1.0.0-x86_64.AppImage.asc AetherSDR-v1.0.0-x86_64.AppImage
Option 2: Verify checksums first, then check the file
gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
sha256sum -c SHA256SUMS.txt
Expected output should show "Good signature from AetherSDR Release Signing".
GPG is typically pre-installed on Linux. If not:
# Arch
sudo pacman -S gnupg
# Debian/Ubuntu
sudo apt install gnupg
macOS Users
The DMG and .pkg are Apple notarized. macOS Gatekeeper verifies the Apple signature automatically — no manual steps required.
Windows Users
The Windows .exe installer and .zip portable build are GPG-signed.
Windows SmartScreen may still show a warning because the binaries are
not Authenticode-signed. This is expected for open-source projects
without an EV code signing certificate. To verify the download:
# Install Gpg4win from https://gpg4win.org/
gpg --import RELEASE-SIGNING-KEY.pub.asc
gpg --verify AetherSDR-Setup-vX.Y.Z.exe.asc AetherSDR-Setup-vX.Y.Z.exe
Commit Signing
All commits on main must be GPG-signed by their author. GitHub displays
a green "Verified" badge on signed commits. Contributors should set up
commit signing with their personal GPG key — see
DEVELOPER-GUIDE.md for setup instructions.