Signing keys

Every published Solera artifact — installer ISOs, system images and packages — is signed with the Solera release key. Use it to verify that what you downloaded is what the project published.

Solera release key

User ID: Solera Linux <release@soleralinux.org>
Primary key fingerprint (RSA-4096, certification): 2A6B 615A 08E0 0125 0DAC 48BE DCDA 556A 3BC6 04A8
Signing subkey fingerprint (RSA-4096, expires 2028-06-06): 7DC3 D1F6 DDFF 5A25 2C69 56C6 52BB FC9B 744E DE63

solera-release.pub Same key in the Git repository

Verify a download

curl -O https://repo.soleralinux.org/stable/iso/solera-latest-x86_64.iso
curl -O https://repo.soleralinux.org/stable/iso/solera-latest-x86_64.iso.sha256
curl -O https://repo.soleralinux.org/stable/iso/solera-latest-x86_64.iso.sig

sha256sum -c solera-latest-x86_64.iso.sha256

curl -fsSL https://www.soleralinux.org/solera-release.pub | gpg --import
gpg --verify solera-latest-x86_64.iso.sig solera-latest-x86_64.iso

gpg --verify must report a good signature from the fingerprint above. To go further and rebuild a release from source against its pinned Arch Linux Archive snapshot, see REPRODUCING.md.