Verifying Your Download

Verifying Your Download
=======================

Every Taskusanakirja binary published at https://taskusanakirja.com/ is signed
with minisign. If you downloaded a binary, you can check that the bytes you got
are the bytes that were built, and that nobody altered them in between.

You can download our minisign public key from

  https://taskusanakirja.com/minisign.pub

We also reproduce it in plain text here:

  RWSqgiOsxOs3YkiY6lf2M/CbYfvhpqYefWmbg9tvwtiTqMQHz4Ul0R48

  Key ID: 6237EBC4AC2382AA

Install minisign (https://jedisct1.github.io/minisign/), then download the
signature file next to the binary you fetched, the same name with `.minisig`
appended. Run

  minisign -Vm taskusanakirja_linux_amd64 -P 'RWSqgiOsxOs3YkiY6lf2M/CbYfvhpqYefWmbg9tvwtiTqMQHz4Ul0R48'

or

  minisign -Vm taskusanakirja_linux_amd64 -p minisign.pub

A good result looks like this:

  Signature and comment signature verified
  Trusted comment: taskusanakirja taskusanakirja_linux_amd64 0.1.0 sha256:… built …

The WASM browser version at https://taskusanakirja.com/ is not signed. Your browser
fetches and runs it in one step. There is no opportunity for you to check anything
in between anyway.