Verify a download

The install script does all of this for you. To check a download yourself, you need ssh-keygen from OpenSSH 8.1 or newer (stock on macOS and common Linux) and shasum or sha256sum.

1. Save the release keys

Save these lines as allowed_signers. They are the same keys the install script carries.

orc-release namespaces="orc-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFU/ODg0J+LstSzNDO8EQGwIJwAwX9P2mpe0tbI1B4wu software-1
orc-release namespaces="orc-release" [email protected] AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBOOiEywnb4pUGjcQoRa5U4oPxQV6CaMgetstDmyWtzq/uf3Ij3e737zNPHOPEGC72R3vcchdpQ2h7OYq9UMCV6UAAAAPc3NoOm9yYy1yZWxlYXNl physical-1

Their fingerprints, to compare with what ssh-keygen -lf prints:

SHA256:udJMX4Jd0m8P7V0I0OWqU8J6X4IBtCUGoyL1LpraxOk (ssh-ed25519 , software-1)
SHA256:5amybWLV7wGfF9gvSxZOMZuRD+vGxuWqYMKGt1zdUeI ([email protected] , physical-1)

2. Check macOS (Apple silicon)

Download the tarball, its checksum file and the signature, then check them in order:

curl -fLO https://dl.sieversii.ca/orc/0.8.2/orc-0.8.2-aarch64-apple-darwin.tar.gz -O https://dl.sieversii.ca/orc/0.8.2/SHA256SUMS-aarch64-apple-darwin -O https://dl.sieversii.ca/orc/0.8.2/SHA256SUMS-aarch64-apple-darwin.sig

ssh-keygen -Y verify -f allowed_signers -I orc-release -n orc-release -s SHA256SUMS-aarch64-apple-darwin.sig < SHA256SUMS-aarch64-apple-darwin

shasum -a 256 -c --ignore-missing SHA256SUMS-aarch64-apple-darwin

2. Check Linux (x86-64)

Download the tarball, its checksum file and the signature, then check them in order:

curl -fLO https://dl.sieversii.ca/orc/0.8.2/orc-0.8.2-x86_64-unknown-linux-gnu.tar.gz -O https://dl.sieversii.ca/orc/0.8.2/SHA256SUMS-x86_64-unknown-linux-gnu -O https://dl.sieversii.ca/orc/0.8.2/SHA256SUMS-x86_64-unknown-linux-gnu.sig

ssh-keygen -Y verify -f allowed_signers -I orc-release -n orc-release -s SHA256SUMS-x86_64-unknown-linux-gnu.sig < SHA256SUMS-x86_64-unknown-linux-gnu

sha256sum -c --ignore-missing SHA256SUMS-x86_64-unknown-linux-gnu

2. Check Linux (arm64)

Download the tarball, its checksum file and the signature, then check them in order:

curl -fLO https://dl.sieversii.ca/orc/0.8.2/orc-0.8.2-aarch64-unknown-linux-gnu.tar.gz -O https://dl.sieversii.ca/orc/0.8.2/SHA256SUMS-aarch64-unknown-linux-gnu -O https://dl.sieversii.ca/orc/0.8.2/SHA256SUMS-aarch64-unknown-linux-gnu.sig

ssh-keygen -Y verify -f allowed_signers -I orc-release -n orc-release -s SHA256SUMS-aarch64-unknown-linux-gnu.sig < SHA256SUMS-aarch64-unknown-linux-gnu

sha256sum -c --ignore-missing SHA256SUMS-aarch64-unknown-linux-gnu

What each step tells you

ssh-keygen -Y verify must print Good "orc-release" signature: the checksum file was signed by one of the keys above.
The checksum check must print OK for the tarball: the archive is exactly the one that was signed.
If a release has no build for a platform yet, its checksum file does not exist (the download fails with a 404).

Keys change only in a reviewed update to this site; a release's own allowed_signers lists the keys trusted at that release, and orc follows key rotations itself when it updates.