Binary Verification
How to verify that your Anyone command-line software is safe to use
Last updated
How to verify that your Anyone command-line software is safe to use
Last updated
Verifying the integrity and authenticity of downloaded software is a critical security step. This page explains how to confirm that the files you're downloading are created and signed by the official Anyone team and have not been modified in transit.
Every ANON release is cryptographically signed using a trusted GPG key. These signatures allow you to independently verify that the files you're about to use match what the developers intended to publish, free from tampering, corruption, or third-party interference.
This guide works for Windows, Mac or Linux.
The steps to verify the anon binaries are advanced but easy to follow:
Gpg4win
On Windows or Mac, download the signing key from the Anyone repository.
On Linux download it with Wget:
Check the key ID of the signing key using a terminal window:
If the ID is a match, then you can continue importing the key to your keychain.
In this example we will use the the Release and Release.gpg files from the ../dists/anon-live-bookworm directory to verify the repository.
To combine the two steps above verify using the InRelease file.
This checks the inline GPG signature against the contents of the file. It does the same thing as verifying Release.gpg with Release, just in one file.
After confirming that the metadata is signed and valid, you can now proceed to verify the packages.
To view and inspect package checksums open the Release file in a text editor on Windows or with the terminal if you are using Linux or Mac:
You'll see some details about the release:
And checksum entries like:
These checksums are used to verify the actual contents of the Packages files and package binaries.
Download the file compressed
Or download the file uncompressed
Search for the Binary in the Packages file
You'll get the following or similar output, it's different for each binary:
Use sha256sum to check the SHA256 of the file
You'll get the following or similar output, it's different for each binary:
Confirm that the SHA256 hash matches what’s listed for the deb file in Packages
From a Command Prompt or PowerShell, check the SHA256 hash of the downloaded binary.
You'll get the following or similar output, it's different for each binary:
Confirm that the SHA256 hash matches what’s listed for the deb file in Packages
GPGTools .
To get the official signing key, download it from the Anyone Repository, check if it's the published on Anyone Protocol GitHub page and import it to .
The ID is published on the official :
If the ID does not match, delete the "anon.asc" file and .
If the signature is valid and matches the imported key, you'll see: gpg: Good signature from "Anon Packages "
Download the Anon Binary
If a hash does not match, delete the binary and return to .
For this example we will verify the same .deb file as before. To find Windows executable, see .
Download the Anon bookworm Binary
If a hash does not match, delete the binary and return to .