signing keys

Public signing keys

unmask packages (rpm / deb / apk) are signed. Installing unmask-release places the public keys under /etc/pki/rpm-gpg/ / /etc/apt/keyrings/ / /etc/apk/keys/, and from then on the package manager verifies every signature on its own.

The one gap is the first install of unmask-release itself (chicken-and-egg: nothing verifies the package that delivers the keys). For that step, compare the fingerprints below across more than one channel — TLS plus a fingerprint cross-check is what anchors the chain of trust.

OpenPGP key (rpm / deb)

User ID

unmask release signing key (rsa 2026 v0.1) <oss@unmask.sh>

Key type

RSA 4096 (signing)

Fingerprint

C03D D45E 28C4 446F DDC4 8EFC 34A3 20B5 44B2 8158

Long Key ID

34A320B544B28158

Created

2026-05-22

Expires

never

Status

production release-signing key (since v0.1 GA, 2026-07-01). Any future rotation will be announced on this page and in the changelog.

Download

RPM-GPG-KEY-unmask

Cross-check

GitHub README (github.com's TLS, independent of this host) · /dl/ repository index

Alpine RSA key (apk)

Key name

oss@unmask.sh-260509 (the filename apk expects under /etc/apk/keys/)

Key type

RSA 4096

SHA-256

63:77:6a:f3:57:b7:be:aa:db:2a:83:67:9d:ae:46:42:
ac:78:6d:ad:49:95:9b:7c:1f:cb:3d:16:5c:c9:a5:dc

Created

2026-05-09

Status

production apk-signing key. Any future rotation will be announced on this page and in the changelog.

Download

unmask.rsa.pub

How to verify

# import the OpenPGP key + show its fingerprint
curl -O https://unmask.sh/dl/keys/RPM-GPG-KEY-unmask
gpg --with-fingerprint --show-keys RPM-GPG-KEY-unmask
# → compare against another channel (this page / the GitHub README)

# one-off rpm verify (after installing the unmask-release rpm)
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-unmask
rpm -K unmask-*.rpm
# → "digests signatures OK" = the chain of trust holds

# apt: verified automatically via the deb-822 sources' Signed-By
sudo apt update    # signature checked on fetch; fails loudly otherwise

# apk: verified automatically once the key sits in /etc/apk/keys/
sudo apk update

Important: to rule out a tampered key, always compare the fingerprint across more than one independent channel — do not rely on this host's TLS alone. The GitHub README carries the same fingerprints over github.com's infrastructure, which is what makes the cross-check meaningful.