Skip to content
Trust and compliance

Supply Chain Security

How to check an InnerWarden host-stack release before you run it: what is signed, where the public key is, its fingerprint, and an OpenSSL recipe that verifies it.

Supply Chain Security

The InnerWarden host stack runs as root, so the install path matters as much as what runs afterwards. This page is how to check a release yourself before you run it, and what that check does and does not prove. The free Community CLI and its installers have their own checks, in Installation.

What is signed

Every file below is on the public releases page, next to its sidecars.

FileSidecarsShipped by
Every host-stack binary: sensor, agent, ctl, supervisor, watchdog, config-sign and dns-guard, for Linux x86_64 and aarch64<file>.sha256 and <file>.sigevery stable release
install.sh, the host installerinstall.sh.sha256 and install.sh.sig0.16.75 and later

Releases before 0.16.75 ship no sidecars for install.sh, so there is nothing to check for the script on them. The binaries it downloads are checked by the script itself, see below.

The two sidecars are different things:

  • .sha256 is in sha256sum format (the hash, two spaces, the file name), so sha256sum -c takes it as shipped. It catches a corrupt or truncated download.
  • .sig is the base64 of a 64-byte Ed25519 signature made over the raw 32-byte SHA-256 digest of the file, not over the file itself. That is why the recipe below hashes first.

The public key

The key is published here, on a different host from the GitHub release that carries the files, so tampering with one cannot also swap the other.

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAvR3bZQMGNQ7tfoKirl4mbBCE6DekmmEFADL5g984PC4=
-----END PUBLIC KEY-----

It is the key install.sh pins inside itself, the key innerwarden-ctl upgrade verifies with, and the key the Community release publishes as innerwarden-release.pub. To get the fingerprint of the file you downloaded, take the last 32 bytes of its DER form:

openssl pkey -pubin -in innerwarden-release-signing.pub.pem -outform DER | tail -c 32 | sha256sum   # macOS: shasum -a 256
#   -> 0bd3a6aaf29dbfe8d3d23983a5bcc0560dd80ec64212b065ca9cd18ba732c494  -

If the two do not match, stop: do not use that key file.

Verify a file

The same four steps work for install.sh and for any binary. This example checks the installer; for a binary, set FILE to its name, for example innerwarden-ctl-linux-x86_64.

V=vX.Y.Z                 # "v" + the release you are about to install
FILE=install.sh          # install.sh needs 0.16.75 or later
base=https://github.com/InnerWarden/innerwarden-releases/releases/download/$V

curl -fsSLO "$base/$FILE"
curl -fsSLO "$base/$FILE.sha256"
curl -fsSLO "$base/$FILE.sig"
curl -fsSLO https://www.innerwarden.com/keys/innerwarden-release-signing.pub.pem

# 1. The key is the published one (compare with the fingerprint above).
openssl pkey -pubin -in innerwarden-release-signing.pub.pem -outform DER | tail -c 32 | sha256sum   # macOS: shasum -a 256

# 2. The download is intact.
sha256sum -c "$FILE.sha256"                               # macOS: shasum -a 256 -c
#   -> install.sh: OK

# 3. The signature is the one the release pipeline made, over the digest of the file.
openssl dgst -sha256 -binary "$FILE" > digest.bin
base64 -d < "$FILE.sig" > sig.bin                         # macOS: base64 -D
openssl pkeyutl -verify -pubin -inkey innerwarden-release-signing.pub.pem -rawin -in digest.bin -sigfile sig.bin
#   -> Signature Verified Successfully

Run the installer only after steps 2 and 3 both pass. Signature Verification Failure means the file, the signature or the key is not the one the release was made with: do not run it, and see Reporting a problem.

Two details that trip people up:

  • Hash first. Giving openssl pkeyutl the file itself instead of digest.bin fails on a genuine release, because the signature covers the digest.
  • You need OpenSSL 3.0 or later. Ubuntu 22.04 and later, Debian 12 and later, RHEL, Rocky and Alma 9 and later, and Fedora 36 and later ship it. On macOS the system openssl is LibreSSL and cannot load an Ed25519 key; use OpenSSL 3 by its full path (brew install openssl@3).

What the installer and the updater check for you

  • install.sh checks each binary it downloads against its .sha256 and against its .sig, using the key pinned inside it, and refuses to continue when a stable release's binary has no signature or a failing one. It needs OpenSSL 3 for this, and says so when the host has an older one.
  • sudo innerwarden-ctl upgrade does the same with the key built into the CLI, before it replaces anything.

The key pinned inside install.sh vouches for the binaries it downloads, never for the script itself, which is why the script ships its own .sha256 and .sig and why this page is the place to check them.

What this does not prove

  • A valid signature shows the file is the one the release pipeline signed with this key. It does not show the pipeline could not have been compromised. The signing key is held by the release pipeline; it is not yet in a hardware module or split between custodians.
  • There is no scheduled key rotation. If the key is rotated, this page, the key file above and the installer change together, and the previous key is listed here as retired.
  • Builds are not reproducible yet, so you cannot rebuild a release from source and compare the bytes.
  • There is no SBOM per release yet. The release pipeline records a build-provenance attestation for each Linux host binary, but it is not publicly fetchable yet; the signature is what you can check yourself.

Reporting a problem

Report it as a security issue, following Vulnerability Disclosure, if you see any of these on a release downloaded from the canonical URLs above:

  • a stable release binary with no .sig or .sha256;
  • a signature that fails with the key published here;
  • a key file whose fingerprint differs from the one on this page;
  • any sign that the signing key is compromised.

For a page that is out of date with a release, tell us in the same way; it is not a security issue.

See also Customer Security Pack, which maps these controls for a procurement review, and Installation.