MUON release signing keys

The manifest key signs the release manifest and signs install.sh with the detached signature install.sh.sig. Public keys below are base64-encoded SPKI DER.

role: release-manifest
keyId: sha256:e63d771f74c661945d3674cf633b8b07d7628536ba9783a958e13b91f341cbb6
publicKey: MCowBQYDK2VwAyEAj38Q783SKDGtQhxTS24pOX2UMgsPipkL1RzlnJHpFxY=

The channel key signs the stable channel pointer, channels/stable.signed.json.

role: release-channel
keyId: sha256:7e0bcc847cd491254dbbf89b3a9cf875c68034198f7c0cf445507a6f9d5363e8
publicKey: MCowBQYDK2VwAyEAVvx9WW+3kZuSJE3vceGIrzkuSFt6JFkNtCHRcG7ivns=

Decode each public key from base64 to DER, then calculate its SHA-256. The resulting hex digest must match the corresponding keyId after the sha256: prefix.

printf '%s' 'MCowBQYDK2VwAyEAj38Q783SKDGtQhxTS24pOX2UMgsPipkL1RzlnJHpFxY=' | openssl base64 -d -A > release-manifest.public.der
shasum -a 256 release-manifest.public.der
printf '%s' 'MCowBQYDK2VwAyEAVvx9WW+3kZuSJE3vceGIrzkuSFt6JFkNtCHRcG7ivns=' | openssl base64 -d -A > release-channel.public.der
shasum -a 256 release-channel.public.der

Convert the checked manifest key to PEM for installer verification:

openssl pkey -pubin -inform DER -in release-manifest.public.der -out release-manifest.public.pem

Node.js 20.10 or newer works with the installer signature. The LibreSSL shipped with macOS does not support the OpenSSL command below. Save this as verify.mjs, then run node verify.mjs. It writes install.sh only after verification succeeds.

import { createHash, createPublicKey, verify } from "node:crypto";
import { writeFileSync } from "node:fs";
// MUON release-manifest key. Cross-check the keyId at https://docs.getmuon.com/release-keys
const KEY = "MCowBQYDK2VwAyEAj38Q783SKDGtQhxTS24pOX2UMgsPipkL1RzlnJHpFxY=";
const KEY_ID = "e63d771f74c661945d3674cf633b8b07d7628536ba9783a958e13b91f341cbb6";
const get = async (url) => { const r = await fetch(url); if (!r.ok) throw new Error(`${url}: HTTP ${r.status}`); return Buffer.from(await r.arrayBuffer()); };
const der = Buffer.from(KEY, "base64");
if (createHash("sha256").update(der).digest("hex") !== KEY_ID) throw new Error("key fingerprint mismatch");
const channel = JSON.parse(await get("https://download.getmuon.com/channels/stable.signed.json"));
const { version } = JSON.parse(Buffer.from(channel.payload, "base64"));
if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error("unexpected version");
const installer = await get("https://getmuon.com/install.sh");
const signature = await get(`https://download.getmuon.com/releases/${version}/install.sh.sig`);
const key = createPublicKey({ key: der, format: "der", type: "spki" });
if (!verify(null, installer, key, signature)) { console.error("SIGNATURE INVALID. Do not run install.sh."); process.exit(1); }
writeFileSync("install.sh", installer);
console.log(`install.sh verified for MUON ${version}`);

Only after “install.sh verified”, run bash install.sh.

The installer verifies downloaded artifacts but cannot verify its own first run. Node.js 20.10 or newer is required. Download it without running it:

curl -fsSLO https://getmuon.com/install.sh

Fetch https://download.getmuon.com/releases/<version>/install.sh.sig for the release bulletin's version and save it as install.sh.sig. Match the installer's version and digest to that bulletin. Use the manifest key checked above and OpenSSL 3 with Ed25519 support (use its binary, not /usr/bin/openssl):

openssl pkeyutl -verify -pubin -inkey release-manifest.public.pem -rawin -in install.sh -sigfile install.sh.sig

Only after verification succeeds, run bash install.sh.

A new release key reaches users only through a signed release that carries both the old and the new keys. This bulletin and the release notes are for independent fingerprint checking, not for authorizing a new key. Entitlement keys cannot sign or recover a release. If every trusted release key is lost or exposed, verify a new installer by hand. Do not trust a key only because a download server sends it alongside a file.