Release trust#

Verify your Automexia v0.4.0 Linux download before installing or running it. The signature authenticates the checksum list; the checksum checks your package.

1. Get the verification files#

Save your chosen package and these two files in the same new folder:

Use Minisign from your distribution's trusted package source and GNU sha256sum. For distributions that provide it, install with sudo apt install minisign or sudo dnf install minisign.

2. Authenticate the checksum list#

The following command contains the pinned v0.4.0 public key:

bash

minisign -Vm SHA256SUMS -x SHA256SUMS.minisig -P 'RWTO3NFbh6cxrzSTATcR6SBkp/bHhwCdR48B+G7IS83pkW8XPqVDrNkN'

Require successful signature verification and exit status zero. If either fails, stop. Do not replace the key with one from an unknown mirror or regenerate the checksum list.

The key was cross-checked against the publisher's pinned verification guide and the attested release asset. First-use trust still depends on the publisher and GitHub account integrity. Keep a trusted copy and investigate future key changes. A key downloaded alongside a package is not independent authentication.

3. Check your exact package#

After the signature succeeds, run:

bash

sha256sum --check --ignore-missing SHA256SUMS

Require your chosen package's exact filename followed by OK, plus exit status zero. Seeing OK for only a guide or key is not proof that your package was downloaded or verified. A missing package, FAILED, warning, or nonzero exit means stop. Then follow Installation.

What the release contains#

The immutable v0.4.0 release contains six Linux packages and ten supporting files. The signed checksum list covers fourteen payload files; the checksum list and signature are the other two.

Supporting files include the public verification key, distribution manifest, SPDX and CycloneDX dependency inventories, release notes, install/removal guides, and third-party notices. The manifest binds each package to an exact size, digest, architecture, version, and source-commit identifier without publishing source.

GitHub's release attestation provides an additional integrity check. Published assets cannot be silently replaced, although the release-page description can change. GitHub's generated Source code ZIPs contain archive metadata, not the terminal application.

Website downloads#

The main download interface offers Linux packages only. Checksums, signatures, and license notices remain available separately. You do not need a build inventory to install a package. The existing v0.4.0 archive still contains its original metadata; immutable assets have not been removed or replaced.

Automexia's /download/ links redirect only to the configured, verified version. Unknown packages and versions return a real 404. Version-pinned routes such as /download/v0.4.0/linux-x64-deb make the selected release explicit.

If a package is withdrawn, the website disables its downloads. Corrected files use a new release; old files are not replaced in place. Never bypass failed verification or use a mirror as a substitute.

Limits and security reports#

Verification confirms package identity and integrity. It does not prove that software has no defects or works on every system. v0.4.0 is a Public Alpha; read its known limitations.

If verification fails or a security product flags a package, pause installation and retain its exact version, filename, and error. Report suspected tampering or vulnerabilities through the private security channel. Do not include credentials, terminal history, or unrelated private data.