v0.2.3-alpha

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 96C225207F2137E278C31CF7AAC48DE8AB8DEE84

Once you have his PGP key you can verify the release (assuming manifest-v0.2.3-alpha.txt and manifest-kaloudis-v0.2.3-alpha.sig are in the current directory) with:

gpg --verify manifest-kaloudis-v0.2.3-alpha.sig manifest-v0.2.3-alpha.txt

You should see the following if the verification was successful:

gpg: Signature made Thu Feb 16 09:02:58 2023 EST
gpg:                using RSA key 96C225207F2137E278C31CF7AAC48DE8AB8DEE84
gpg:                issuer "zeusln@tutanota.com"
gpg: Good signature from "Zeus LN <zeusln@tutanota.com>" [ultimate]
Primary key fingerprint: 96C2 2520 7F21 37E2 78C3  1CF7 AAC4 8DE8 AB8D EE84

That will verify the signature on the main manifest page which ensures integrity and authenticity of the binaries you've downloaded locally. Next, depending on your operating system you should then re-calculate the sha256 sum of the binary, and compare that with the following hashes:

cat manifest-v0.2.3-alpha.txt

One can use the shasum -a 256 <file name here> tool in order to re-compute the sha256 hash of the target binary for your operating system. The produced hash should be compared with the hashes listed above and they should match exactly.

Finally, you can also verify the tag itself with the following command:

git verify-tag v0.2.3-alpha

What's Changed

• multi: add autopilot stubs by @ellemouton in #67

Full Changelog: v0.2.2-alpha...v0.2.3-alpha