The Sysible release key
Signing key & fingerprint
Sysible Release Signing
[email protected] · ed25519 · created 2026-08-16
Fingerprint
000E A109 6CC1 5D9F A5BE 244B 393D 58FA 004F 1B52
Confirm this fingerprint out-of-band before you trust the key — it is the anchor for every signed Sysible release.
Public key
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEaoI5vRYJKwYBBAHaRw8BAQdAXHCYPo3U4lbPBS+TytWqw2mc0wejmb/uq5hC xEulpJe0LFN5c2libGUgUmVsZWFzZSBTaWduaW5nIDxzb3VyY2VAc3lzaWJsZS5j b20+iJAEExYKADgWIQQADqEJbMFdn6W+JEs5PVj6AE8bUgUCaoI5vQIbIwULCQgH AgYVCgkICwIEFgIDAQIeAQIXgAAKCRA5PVj6AE8bUhEKAQDeAC71hL6DxBQvBc07 RzaSUxIxyLZI7j+/GqrONbxXKgD+OX+fpDrI2vw9++NvQcoW5Al/5j8onRQY1Pqz aoda1gy4OARqgjm9EgorBgEEAZdVAQUBAQdALjTe1dLXAyndxervvMB2xhyK+j5T IyWjbmAmhzLdN1cDAQgHiHgEGBYKACAWIQQADqEJbMFdn6W+JEs5PVj6AE8bUgUC aoI5vQIbDAAKCRA5PVj6AE8bUrrCAP0d0KiNaovf0W/B+Tub+CjslwRDqL4oRTHd 7C1rHCQB6QD+J1kMX7bvph7QQ20FJwz+stmFJRUhnR5j6nIo3HN9uAc= =R+FE -----END PGP PUBLIC KEY BLOCK-----
How to verify
Check a download
Download the ISO parts plus the SHA256SUMS.<arch>* files and their .gpg signatures, then (example for amd64):
# 1. import the Sysible release key (once) curl -fsSL https://sysible.com/sysible-release-key.asc | gpg --import # 2. verify the signature on the checksums (authenticity) gpg --verify SHA256SUMS.amd64.parts.gpg SHA256SUMS.amd64.parts # 3. verify the parts, reassemble, verify the whole ISO sha256sum -c SHA256SUMS.amd64.parts cat live-image-amd64.hybrid.iso.*.part > live-image-amd64.hybrid.iso gpg --verify SHA256SUMS.amd64.gpg SHA256SUMS.amd64 sha256sum -c SHA256SUMS.amd64
✓
A Good signature from 393D58FA004F1B52 matching the fingerprint above means the checksums are authentic. GPG may add a "not certified with a trusted signature" note — that's expected until you locally sign the key; the fingerprint match is what matters.