Verifying an ULTIMA release

Every release is a wheel, a SHA-256 checksum, and a detached OpenPGP signature. Verifying them answers two different questions, and it is worth being precise about which:

• The checksum tells you the file you have is the file that was published.

It catches a truncated download or a corrupted mirror. It does not tell you who published it, because anyone who can replace the wheel can replace the checksum next to it.

• The signature tells you the file was signed by the holder of the key

below. That is the part an attacker cannot forge by controlling the download.

The signing key

Lead Rescue LLC <saul@sitesbysaul.com>
ed25519, created 2026-09-16, expires 2028-09-15

270D 62C3 B9D6 D8CF 169A  2851 A1D4 0619 40E1 DECC

The public key ships as ultima-signing-key.asc.

Confirm the fingerprint out of band. Importing the key from the same place you downloaded the wheel proves only that both came from the same source — if that source is compromised, so is the key you just trusted. Compare the fingerprint against a channel the download cannot control: a signed email from Lead Rescue LLC, a contract or invoice, the vendor's website over HTTPS, or a phone call. A fingerprint that only ever arrived alongside the artifact is not independent evidence.

Verify

# 1. Integrity
sha256sum -c SHA256SUMS

# 2. Authenticity
gpg --import ultima-signing-key.asc
gpg --verify ultima_kernel-0.1.0-py3-none-any.whl.asc \
             ultima_kernel-0.1.0-py3-none-any.whl

A good signature prints:

gpg: Good signature from "Lead Rescue LLC <saul@sitesbysaul.com>"

GnuPG will also warn that the key is not certified with a trusted signature. That is expected and is not a failure: it means you have not personally signed this key, which is what the out-of-band fingerprint check above replaces. What matters is Good signature and that the key id in the output matches the fingerprint above.

If verification fails

Stop. Do not install the wheel.

• sha256sum mismatch, gpg: BAD signature, or a different fingerprint than

the one published here: treat the artifact as untrusted and contact Lead Rescue LLC through a channel you already trusted before the download.

• gpg: Can't check signature: No public key: the key was not imported. Run

the import step.

• gpg: Note: This key has expired!: the signature may still be valid for the

period the key was live, but confirm the current key with the vendor before relying on it.

Reproducing the build

The wheel is byte-for-byte reproducible from its source revision. SOURCE_DATE_EPOCH is pinned to the commit timestamp, so the same commit always produces the same wheel, and ops/release-check.sh builds twice and refuses to publish if the two disagree. If you hold the source, you can rebuild a revision and confirm the digest matches the one that was shipped rather than taking the published checksum on trust. See Testing.

Key rotation

This key expires 2028-09-15. A replacement will be published with its own fingerprint, and the change announced through the same channel you used to confirm the fingerprint originally. If a key is ever compromised, Lead Rescue LLC publishes a revocation certificate; an imported key that later shows as revoked should be treated as untrusted for every artifact you have not already verified.