Release Signing Key

Key created: July 2026

Open Headers releases ship a SHA256SUMS.txt checksums manifest covering the standalone oh (CLI) and ohd (daemon) binaries, with a detached GPG signature SHA256SUMS.txt.asc alongside it. This page publishes the key that makes that signature, so you can verify a download came from us — a trust root independent of the TLS connection you fetched it over.

Key details

User ID	`OpenHeaders Release Signing <security@openheaders.io>`
Algorithm	Ed25519, sign-only
Expiry	None — superseded here if ever rotated or revoked
Fingerprint	`867B 1FF4 CD09 AC02 6417 B00A C55F BF5E 1E1E E683`

The key is downloadable as openheaders-release-key.asc and attached to each release that carries a signed manifest. Cross-check the fingerprint against an independent copy — it is also published in the security policy on GitHub. If the fingerprints ever disagree, trust neither and report it.

Verifying a download

# One-time: import the signing key and check its fingerprint
curl -fsSLO https://openheaders.io/openheaders-release-key.asc
gpg --import openheaders-release-key.asc
gpg --fingerprint security@openheaders.io

# Per release: fetch the manifest + signature next to your download
curl -fsSLO https://github.com/OpenHeaders/open-headers/releases/latest/download/SHA256SUMS.txt
curl -fsSLO https://github.com/OpenHeaders/open-headers/releases/latest/download/SHA256SUMS.txt.asc

# Verify the manifest, then your file against it
gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
shasum -a 256 --check --ignore-missing SHA256SUMS.txt

gpg --verify must report a good signature from OpenHeaders Release Signing <security@openheaders.io> with the fingerprint above. A warning that the key is “not certified with a trusted signature” is normal — it means you haven’t marked the key as trusted in your local keyring, not that the signature is bad.

The GPG signature covers the standalone binaries’ manifest. The installers carry their own platform trust roots on top: Windows artifacts are Authenticode-signed, macOS artifacts are Developer ID-signed and notarized by Apple, and the browser extensions install only through the official stores.

Public key