Release Verification
July 26, 2026 ยท View on GitHub
Status: Active Scope: public, current-state Last reviewed: 2026-07-26 Owner: AX Code release engineering
ax-minisign.pub is the canonical public key for AX Code release signatures. Installers, release
workflows, and publishing scripts read this checked-in copy; GitHub releases also publish the same key as an asset.
To verify a downloaded asset and its detached signature:
minisign -V \
-p docs/release/ax-minisign.pub \
-m ax-code-darwin-arm64.zip \
-x ax-code-darwin-arm64.zip.minisig
On Windows (PowerShell), the same public key verifies CLI archives and the installer script:
# From a checkout, or use the key string from SECURITY.md / install.ps1
minisign -V -p docs/release/ax-minisign.pub -m ax-code-windows-x64.zip -x ax-code-windows-x64.zip.minisig
minisign -V -p docs/release/ax-minisign.pub -m install.ps1 -x install.ps1.minisig
# Inline key form (matches what install.ps1 uses)
$minisign = "RWSlDu++afxCz01OqhYWhfo8+L8pVbSYXJBEb2zoWBuK0WACIzbGVZRO"
minisign -Vm ax-code-windows-arm64.zip -x ax-code-windows-arm64.zip.minisig -P $minisign
The Bash and PowerShell installers fail closed when verification fails. When minisign is not already on
PATH, they bootstrap a pinned official minisign release (SHA-256 checked) into a local tools cache and use
it for verification, unless AX_CODE_SKIP_MINISIGN_VERIFY=1 is set intentionally.
Treat a key mismatch or failed signature as a release-integrity failure. Do not replace the key without updating the release workflows, installer verification, and key-rotation guidance in the same change.
See Installation and Runtime Channels for supported distribution channels.