Verify a self-hosted release
The self-hosted DumpTriage engine ships as one tarball per release: the engine's container images, the Windows and Linux worker kits, SBOMs and the install CLI. We sign every bundle with one Ed25519 key. Check a bundle against that key, from here and not from the copy inside the bundle, before you run anything from it.
The release key
| Public key | dumptriage-release-signing.pub |
| SHA-256 of the DER public key | df338f63278b298208b177dba7bdd000d2314e6a745c9cc99ee375c980935b76 |
Shown by dumptriage verify | df338f63278b2982 (the first 16 hex characters) |
The same value is published in places that are changed separately, so a forged key would have to change all of them. Compare at least two:
- this page;
- DNS:
dig +short TXT _dumptriage-release-key.performanceinsights.ai; - the dumptriage-releases repository's
release-signing.pubandverify.sh; - the release notes that come with each bundle.
The same key signs the seed knowledge base bundles that dumptriage kb-import takes. If we ever replace it, the new key is announced in all of these places, and in a release signed with the old one, first.
Getting a bundle
The self-hosted engine is not a public download. Write to us and tell us what you would run it on. We'll talk it through and send you the bundle. You receive four files: dumptriage-X.Y.Z.tar, its .sha256, SHA256SUMS (every file inside the bundle) and SHA256SUMS.sig (our signature of it). Everything you need to check them is public.
Check it
On a Linux host with OpenSSL 3.0 or later, in the folder with the four files:
curl -fsSLO https://performanceinsights.ai/.well-known/dumptriage-release-signing.pub openssl pkey -pubin -in dumptriage-release-signing.pub -outform DER | sha256sum # must print the value above sha256sum -c dumptriage-1.32.0.tar.sha256 openssl pkeyutl -verify -pubin -inkey dumptriage-release-signing.pub -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig mkdir unpacked && tar -xf dumptriage-1.32.0.tar -C unpacked && cd unpacked/dumptriage-1.32.0 # a new, empty directory cmp SHA256SUMS ../../SHA256SUMS && sha256sum --strict -c SHA256SUMS infra/selfhost/dumptriage verify --key ../../dumptriage-release-signing.pub
Or let verify.sh in the releases repository do all of that, after you have read it: ./verify.sh --dir followed by the folder with the four files.
Each tarball also has a provenance attestation from that repository's workflow, which checked it the same way before we sent it:
gh attestation verify dumptriage-1.32.0.tar -R performanceinsights-ai/dumptriage-releases
The attestation shows which workflow checked that exact file. It does not show which commit built it: bundles are built and signed in our private repository. The signature is what ties a bundle to us.