# MinIO AIStor release signing keys

MinIO AIStor downloads are signed with two keys:

| Key | File | Check against |
|---|---|---|
| GPG | [`minio-gpg.asc`](minio-gpg.asc) | Fingerprint `4405 F3F0 DDBA 1B9E 68A3  1D25 12C7 4390 F9AA C728` (expires 2027-01-05) |
| minisign | [`minio-minisign.pub`](minio-minisign.pub) | `RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav` |

Every binary has a GPG signature (`.asc`) and a minisign signature (`.minisig`) beside it. From `11.0.0-edge`,
every deb, rpm and apk package has them too, rpm packages are also signed inside, and `release.json` and
`channels.json` are signed with minisign. Packages of date-based releases (`RELEASE.*`, `EDGE.*`) are not signed.

## Import

```sh
curl -fsSLO https://dl.min.io/keys/minio-gpg.asc
gpg --show-keys minio-gpg.asc        # compare the full fingerprint above, not a short key ID
gpg --import minio-gpg.asc
sudo rpm --import minio-gpg.asc      # for rpm -Kv
curl -fsSLO https://dl.min.io/keys/minio-minisign.pub
```

The GPG key is also on `keyserver.ubuntu.com`.

## Verify

```sh
gpg --verify minio.asc minio                # "Good signature" and the fingerprint above
minisign -Vm minio -p minio-minisign.pub    # "Signature and comment signature verified"
rpm -Kv <package>.rpm                       # signature line ends "f9aac728: OK"
```

gpg's warning that the key "is not certified with a trusted signature" is expected; the fingerprint is what matters.

For a labelled release, verify its `release.json`, which lists the SHA-256 checksum of every binary and package in
the release:

```sh
minisign -Vm release.json -p minio-minisign.pub
```

## Key expiry

The GPG key's expiry will be extended before 2027-01-05; its fingerprint stays the same. Download and import the
key again then. For rpm, first remove the old copy: `sudo rpm -e --allmatches gpg-pubkey-f9aac728`.