Verify Your Download

All BastionGuard releases are digitally signed using the official BastionGuard GPG signing key.

Before installing or running any software, we strongly recommend verifying its authenticity and integrity.

Since BastionGuard packages are distributed as standalone files and not through official package repositories, all downloads must be verified manually before installation.

Official Signing Key

Key ID: 68D08974A276CF8A
Fingerprint:

E33B 4BC4 CAC6 FA6F 1CCA 2397 68D0 8974 A276 CF8A

The public key is available on the official website and on trusted public keyservers (keys.openpgp.org).

1. Import the Official BastionGuard Signing Key

This step is required only once.

Automatic import:

curl -fsSL https://bastionguard.eu/keys/bastionguard-release.gpg | gpg --import

Manual import:

gpg --import bastionguard-release.gpg

2. Verify the Fingerprint

After importing the key, verify that the fingerprint matches exactly:

gpg --fingerprint info@bastionguard.it

Expected fingerprint:

E33B 4BC4 CAC6 FA6F 1CCA 2397 68D0 8974 A276 CF8A

Important: Only the primary key fingerprint above should be used as the trust reference. GPG may display a different fingerprint for signing subkeys. This is normal.

3. Verify the Checksum Signature (Recommended)

Each release includes a signed checksum file.

Download:

  • zip sign key
  • The software package

Verify the signature:

gpg --verify release-1.0.0-SHA256SUMS.asc release-1.0.0-SHA256SUMS

Expected output:

Good signature from "BastionGuard..."

If the signature is invalid, do not use the files.

4. Verify File Integrity

After verifying the checksum signature, validate file integrity:

sha256sum -c SHA256SUMS

Expected result:

BastionGuard-xxx: OK

Any failure indicates file corruption or tampering.

5. Verify Direct File Signatures (Optional)

Some packages are provided with individual detached signatures.

Generic example:

gpg --verify FILE.asc FILE

Example (AppImage):

gpg --verify BastionGuard-1.0.0-x86_64.AppImage.asc \
BastionGuard-1.0.0-x86_64.AppImage

6. Supported Distribution Packages

BastionGuard provides signed packages for:

  • Debian / Ubuntu (.deb)
  • Fedora / RHEL / OpenSUSE (.rpm)
  • Arch Linux (.pkg.tar.zst)

No official package repositories are currently available.

All packages are distributed as standalone files and must be verified manually.

Each package is either:

  • Individually signed, or
  • Included in a signed checksum file

Examples

Debian / RPM / AppImage:

gpg --verify package-file.asc package-file

Arch Linux:

gpg --verify package.pkg.tar.zst.sig package.pkg.tar.zst

7. Why Verification Is Important

Verifying digital signatures ensures that:

  • The software was released by BastionGuard
  • The file has not been modified
  • The download was not tampered with
  • Your system is protected from malicious replacements

Skipping verification exposes your system to serious security risks.

8. Security Notice

If any verification step fails:

  • Do NOT install the software
  • Do NOT execute the file
  • Delete the downloaded files
  • Contact us immediately

Email: info@bastionguard.it
Issues: https://bastionguard.eu/issues/

9. Public Signing Key

The official BastionGuard public signing key:

https://bastionguard.eu/keys/bastionguard-release.gpg

Only trust software signed with this key.

10. Quick Verification (Advanced Users)

curl -O https://bastionguard.eu/keys/bastionguard-release.gpg
gpg --import bastionguard-release.gpg

gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

📞 Contact

For security questions, signature issues, or responsible disclosure:

Email: info@bastionguard.eu
Issues: https://bastionguard.eu/issues/

Published on:
Last updated on: