Verifying downloads

What is signed

Each release directory on releases.ant0.link contains the installers, a SHA256SUMS.txt with the hash of every file, and SHA256SUMS.txt.minisig, the minisign signature of that list. The signing key never leaves Ant0’s build server; its public half is:

RWTvXmwMqczy1xMs5KJs+qS9x7LmikRzIX+la3WGmWIFEKvQvR1JW8d9

The same key signs the browser engine the app downloads, and the app’s in-app updater refuses anything that does not verify. The download page prints the SHA-256 of each current file so a quick check needs no extra tool.

Quick check: the hash

Windows (PowerShell):

Get-FileHash .\Ant0_<version>_x64-setup.exe -Algorithm SHA256

Linux:

sha256sum Ant0_<version>_amd64.deb

Replace <version> with the version shown on the download page, then compare the result with the SHA-256 printed there. They must match exactly.

Full check: the signature

The signature proves that the list of hashes came from Ant0; checking the file against the list then proves the file was not altered.

Linux (apt install minisign on Debian and Ubuntu):

V=<version>; B=https://releases.ant0.link/ant0-releases/desktop/$V
curl -fsSLO "$B/SHA256SUMS.txt" -O "$B/SHA256SUMS.txt.minisig" -O "$B/Ant0_${V}_amd64.deb"
minisign -Vm SHA256SUMS.txt -P RWTvXmwMqczy1xMs5KJs+qS9x7LmikRzIX+la3WGmWIFEKvQvR1JW8d9
sha256sum -c --ignore-missing SHA256SUMS.txt

Windows: minisign is available through winget install minisign or from the project’s releases. Then, in the folder with the three files:

minisign -Vm SHA256SUMS.txt -P RWTvXmwMqczy1xMs5KJs+qS9x7LmikRzIX+la3WGmWIFEKvQvR1JW8d9
(Get-FileHash .\Ant0_<version>_x64-setup.exe -Algorithm SHA256).Hash.ToLower() -eq ((Get-Content SHA256SUMS.txt | Select-String 'x64-setup.exe') -split ' ')[0]

Signature and comment signature verified followed by True (or OK on Linux) means the file is the one Ant0 published.

Windows SmartScreen

The Windows installer is not yet signed with an Authenticode certificate, so Windows shows “Windows protected your PC” on first run. The minisign signature above is the check that matters; once the hash matches, choose More info → Run anyway. Code signing will follow before the app leaves early access.

If something does not match

Do not install. Download again from the download page; if it still does not match, do not use that file. Report the file name and hash to {{public:security}}.