Security & Verification

How to verify the integrity of Mooring install scripts.

Two-Layer Verification

Mooring install scripts protect themselves with two independent integrity checks:

Both layers run automatically during install. If either check fails, the installer stops and tells you what happened.

GPG Public Key

All Mooring releases are signed by:

Plateau Lane Studios Releases <releases [at] plateaulanestudios [dot] com>

Fingerprint:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEacnyHxYJKwYBBAHaRw8BAQdAToOVw47zi5Yy6Py/Y3xfK3JyeOBieyLdVbaD
ga3VgUu0P1BsYXRlYXUgTGFuZSBTdHVkaW9zIFJlbGVhc2VzIDxyZWxlYXNlc0Bw
bGF0ZWF1bGFuZXN0dWRpb3MuY29tPoiTBBMWCgA7FiEEXeud1ZDh4UeH1waEBIMq
JfvCa7MFAmnJ8h8CGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQBIMq
JfvCa7MSpAD+NEJpybeDn6PpO6F6TLGwYTFOy/C3CMEk/eaEcT85dH4BAJy1m2Uu
vY36DICvWpR2UHHAyqfaGbXh0JDIgdK0NyEK
=L5PW
-----END PGP PUBLIC KEY BLOCK-----

Manual Verification

If you prefer to verify before running the installer:

# 1. Download the signing key and import it
curl -fsSL https://plateaulanestudios.com/mooring/security/release-signing-key.asc | gpg --import

# 2. Download the checksums and signature for your version
VERSION="0.6.3"  # replace with your version
curl -fsSL "https://plateaulanestudios.com/mooring/v${VERSION}/checksums.txt" -o checksums.txt
curl -fsSL "https://plateaulanestudios.com/mooring/v${VERSION}/checksums.txt.sig" -o checksums.txt.sig

# 3. Verify the signature
gpg --verify checksums.txt.sig checksums.txt

# 4. Verify the install script against the checksums
sha256sum --check checksums.txt

You should see Good signature from "Plateau Lane Studios Releases" and each file listed as OK.

Key Distribution

The public key is available from multiple independent sources so you can cross-verify:

Questions? Contact security [at] plateaulanestudios [dot] com