Release Signing Keys

Every Cloud Fellows product release is published with a checksum file and a detached OpenPGP signature over it. This page holds the public keys used to make those signatures, so you can confirm that a download really came from us and arrived unmodified.

You reached this page the right way if you navigated here from cloudfellows.de. That matters: a fingerprint is only worth checking if you obtained it independently of the file you are checking. Never take a key or a fingerprint from the same place — or the same document — that gave you the download.

Current key

This is the key in use for all current releases:

The Installation Notes published with each release name the key that release was signed with and repeat its fingerprint, so you can confirm the two agree.

Retired keys

None. This is the first Cloud Fellows release signing key. When a key is retired it stays listed here, with the period it was valid for, so that older releases remain verifiable.

Importing the key

Download the key, look at it, and only then import it. --show-keys reads the file without importing anything, so you can compare the fingerprint before you commit to it:

curl -O https://www.cloudfellows.de/cloudfellows-release-signing-key-2026.asc
gpg --show-keys cloudfellows-release-signing-key-2026.asc
gpg --import cloudfellows-release-signing-key-2026.asc

The fingerprint that --show-keys prints must be the same forty hex digits as the one in the table above. It prints them as one unbroken run rather than in the spaced groups shown here — that is only formatting; the digits and their order are what must agree. If they do not, stop — do not import the key, and please tell us.

This is a one-time step. The same key verifies every release until it is retired.

Verifying a download

Each release publishes two files alongside the product archives: a .SHA256SUMS file listing the checksums, and a .SHA256SUMS.asc detached signature over it. Check the signature first, then the checksums — verifying a checksum file before establishing that it is authentic proves nothing:

gpg --verify <product-version-date>.SHA256SUMS.asc <product-version-date>.SHA256SUMS
shasum -a 256 --ignore-missing -c <product-version-date>.SHA256SUMS

<product-version-date> stands for the prefix the release you downloaded actually carries — product name, version and build date — and is the same on all four filenames. If your system has no shasum, use sha256sum --ignore-missing -c instead. Keep --ignore-missing either way: the checksum file covers every architecture we publish and you downloaded one of them, and without the flag the tool reports the ones you do not have as failures.

Reading the result

A successful check looks like this:

gpg: Good signature from "Cloud Fellows GmbH" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
<product-version-date>-linux-x86_64.tar.gz: OK

That warning is normal and is not a problem. It and the [unknown] marker mean only that you have not personally certified our key in your own OpenPGP web of trust — something almost nobody does for a vendor key. Neither says anything about whether the signature is good. What matters is the Good signature line together with a fingerprint you checked against the table above.

Anything else deserves attention:

Do not install a package that does not verify.