Signing keys

Flesance signs what it publishes with keys of its own. This page lists them, so that you can compare what reached your computer with a copy that did not come with it. The studio and the packages carry the same keys. If a file says something different from this page, do not install it, and tell us.

The master key

The key that vouches for the others. It is a composite key, ML-DSA-65 and Ed25519 together (id-MLDSA65-Ed25519-SHA512): a signature counts only when both halves are valid, so it holds even if one of the two methods is broken one day. Its public half is built into every copy of the studio and never changes. Its private half is kept on a device of its own, never on a computer that builds or publishes Flesance. It signs rarely: the certificate of each update signing key, and the statement that names the repository key.

Fingerprint

fe6d d65e 9e16 6325

SHA-256 of the key

fe6dd65e9e1663250ca6cb09fe274fff39f394ba97cece818ae7d7ba66f107e1

The public key

master-key.txt, base64 of its 1984 bytes

The fingerprint is the first sixteen digits of the SHA-256 of the key’s bytes. To check the file:

curl -fsSL https://flesance.studio/keys/master-key.txt | base64 -d | sha256sum

The update signing key

The studio learns of a new version from a file that lists every file of the release with its SHA-256, and it shows our notices from another. Both are signed by the update signing key, and the studio believes them only when the master key has certified that key. When an AppImage updates itself, the new file replaces the old one only if its SHA-256 matches that signed list.

Fingerprint

1761 bc2e 82c2 0a35

SHA-256 of the key

1761bc2e82c20a35f34543db906504deb4be96a6603977a5e49b3ed46a5f9467

Certificate

number 1, valid from 19 October 2026 to 19 October 2027 (UTC), update-key-certificate.txt

The certificate is a short text signed by the master key: its number, which files the key may sign, the first and last day it may sign them, and the key. Every signature file the studio reads, such as updates.json.sig, begins with the same two lines.

This key is replaced regularly, and at once if it may have leaked: the master key certifies a new one under a higher number. A studio that has seen a certificate refuses every lower one from then on, so a replaced key stops being believed without a new version of the studio. When the key is replaced, this page shows the new one.

The repository key

apt, dnf and zypper check OpenPGP signatures, so our package repositories have an OpenPGP key: Ed25519, in two levels. The primary key only certifies signing subkeys, and is kept with the master key. The signing subkey signs every .rpm and the index of both repositories, and is replaced every year. Every .deb and .rpm carries the key and adds our repository to the system, so that Flesance is updated with everything else.

Primary key

93B1 8AC5 E9DA 837F C29F D8D7 1283 2B04 8F7C 937D

Signing subkey

C9E4 4FC9 DA3C BB5D 03D4 463B 6E06 2AA4 20F5 B5EA, valid until 19 October 2027

Tied to the master key by

a statement naming the primary key, and the master key’s signature over it

To see the key the repositories serve, with its fingerprints:

curl -fsSL https://apt.flesance.studio/flesance.gpg | gpg --show-keyscurl -fsSL https://rpm.flesance.studio/flesance.asc | gpg --show-keys

The fingerprints gpg prints must be the two above. The statement is signed by the master key (id-MLDSA65-Ed25519-SHA512, with an empty context), so the repository key answers to the same master as the studio’s updates.

Checking a download

Any file. Every file of a release has its SHA-256 beside it, under the same name with .sha256 added, and each version has every checksum in one file, SHA256SUMS. The download page lists the same values. In the folder with the file and its .sha256:

sha256sum -c flesance-*.sha256

A checksum shows that the file arrived whole. It comes from the same place as the file, so it cannot show who made it; the signatures below can.

An .rpm is signed with the repository key. Import the key once, then check the file; rpm should answer digests signatures OK:

sudo rpm --import https://rpm.flesance.studio/flesance.ascrpm -K flesance-*.rpm

A .deb is not signed by itself: apt checks the repository’s signed index, which lists every package with its SHA-256, and does so on every install and update. To follow the same steps by hand: check the index’s signature, then that the list of packages has the SHA-256 the index names, then that your .deb has the SHA-256 the list names. On ARM, read arm64 for amd64.

curl -fsSLO https://apt.flesance.studio/flesance.gpgcurl -fsSLO https://apt.flesance.studio/dists/stable/InReleasegpgv --keyring ./flesance.gpg --output Release InReleasecurl -fsSLO https://apt.flesance.studio/dists/stable/main/binary-amd64/Packagesgrep binary-amd64/Packages$ Releasesha256sum Packagesgrep -e ^Filename -e ^SHA256 Packagessha256sum flesance-*.deb

gpgv should report a good signature from the signing subkey above. dnf and zypper check the rpm repository’s index the same way, with the same key.