Verifying a download
Every release is signed with an Ed25519 key so you can confirm the zip is authentic and uncorrupted before installing. Each release ships:
| File | Purpose |
|---|---|
gmcheems-extension.zip | The extension build |
gmcheems-extension.zip.sig | Ed25519 detached signature (base64) |
gmcheems-extension.zip.sha256 | SHA-256 checksum (shasum -c format) |
The linked files always point at the latest release. The Ed25519 public key
used to sign them, release.pub.pem, is hosted here
rather than in the release itself.
If you installed from the Chrome Web Store, Google handles this for you. The steps below are for verifying a zip you downloaded by hand.
In your browser (easiest)
Select the zip and its .sig file below (and the .sha256 too, if you
downloaded it). Verification happens right here on this page, nothing is
uploaded anywhere.
This runs entirely in your browser using the Web Crypto API. Your files are never uploaded anywhere.
With openssl + shasum
Requires OpenSSL 1.1.1+ (not LibreSSL, which is macOS's default
/usr/bin/openssl, install OpenSSL via Homebrew if needed). Download
release.pub.pem, then confirm it matches the
fingerprint above before trusting it:
# 0. Verify the public key itself (cross-check its fingerprint out-of-band)
openssl pkey -pubin -in release.pub.pem -outform DER | shasum -a 256 # macOS
# openssl pkey -pubin -in release.pub.pem -outform DER | sha256sum # Linux
# Must match: 086a1b042f020748f4f2a291a0a7850b2fd72ff391d387b7a8604a3413aaf47e
Then verify the zip:
# 1. Integrity: SHA-256 checksum
shasum -a 256 -c gmcheems-extension.zip.sha256 # macOS
# sha256sum -c gmcheems-extension.zip.sha256 # Linux
# 2. Authenticity: Ed25519 signature
openssl base64 -d -in gmcheems-extension.zip.sig -out gmcheems-extension.zip.sig.raw
openssl pkeyutl -verify -rawin -pubin -inkey release.pub.pem \
-in gmcheems-extension.zip -sigfile gmcheems-extension.zip.sig.raw
Both print "OK" / "Signature Verified Successfully" on success and exit non-zero on any mismatch. Do not install the zip if any check fails (including the fingerprint check in step 0, a mismatch means the shipped key may have been replaced).