npub1q9geyrch3feyczz242sxjaa05yczv50dlpug082sjln2kl0wrnxst0nrfa/bitflash/docs/release-verification.md, branch main [no description] https://upleb.uk/npub1q9geyrch3feyczz242sxjaa05yczv50dlpug082sjln2kl0wrnxst0nrfa/bitflash/atom?h=main 2026-08-13T17:35:49+00:00 release: verify bundled Tor signatures 2026-08-13T17:35:49+00:00 Nsable-sh nsable-sh@noreply.git.bitflash.network 2026-08-13T17:35:49+00:00 urn:sha1:03e583395c42124521d09287bef29bf1d1bbe59b release: package Windows builds with managed Tor 2026-08-13T17:29:14+00:00 Nsable-sh nsable-sh@noreply.git.bitflash.network 2026-08-13T17:29:14+00:00 urn:sha1:44fbf6895bd3acd11f552514e746a2e3876cad2d site: document public deployment contract 2026-08-12T14:58:03+00:00 Nsable-sh nsable-sh@noreply.git.bitflash.network 2026-08-12T14:58:03+00:00 urn:sha1:b0ed2ce585d2a6fd7c6d8d4db7422734aedccb58 release: sign SHA256SUMS with a pinned key, verify against it 2026-08-06T13:46:26+00:00 Bitflash admin@bitflash.network 2026-08-06T13:46:26+00:00 urn:sha1:c3f6b68f907b03865d2c417ee39fe9526787196f verify-release.sh embeds the Bitflash release signing key and now requires that the checksum signature validate against that exact key, not merely against some key in the caller's keyring (#138). It also fetches releases from releases.bitflash.network instead of the retired GitHub host, resolving 'latest' from latest.txt. Release signing key fingerprint: 910A 2B4C CA87 9E81 FB4B 2AEA 1D4A 53D3 B78A A4B8 Add release verification tooling (#108) 2026-08-04T13:18:01+00:00 mtg0001 106211915+mtg0001@users.noreply.github.com 2026-08-04T13:18:01+00:00 urn:sha1:f6c5b813075cae4228d241a3567e70b210504749 Co-authored-by: Gilcimar Duarte <ti@gpm.infra>