Release mirror and key

Every release of Dassie is published on get.dassie.land and signed with one key. The installer and the updater check that signature before they unpack anything. This page shows what is where, and how to check a download yourself.

What is where

Each release has a directory of its own, named by its version, such as 0.3.0:

https://get.dassie.land/meta/latest

The newest release's version, as plain text. It is not signed, so it never decides the direction: the installer and the updater move to it only if it is newer than what you run.

https://get.dassie.land/<version>/dassie-<version>-linux-x64.tar.gz

The bundle for x86-64 Linux. Inside, dassie/bin/dassie is the one static binary, with the wallet built in, and dassie/share/systemd/ holds the release's systemd units.

https://get.dassie.land/<version>/dassie-<version>-linux-arm64.tar.gz

The same for 64-bit ARM Linux.

https://get.dassie.land/<version>/flake.tar.gz

The flake for NixOS: a module, and a package made from the release's own bundles, by their sums. See Dassie on NixOS.

https://get.dassie.land/<version>/SHA256SUMS

The SHA-256 sum of each bundle and of the flake.

https://get.dassie.land/<version>/SHA256SUMS.minisig

The release key's minisign signature of SHA256SUMS. Its trusted comment is dassie <version>, so the signed sums of one release cannot pass for another's.

https://get.dassie.land/flake/latest.tar.gz

The newest release's flake. It is served with a Link: <https://get.dassie.land/<version>/flake.tar.gz>; rel="immutable" header, so Nix locks the version it named, and your lock stays good once the next release is out.

https://sh.dassie.land

The installer, install.sh, with the release key built in. The mirror holds the same script at https://get.dassie.land/install.sh.

These names never change. Every node's updater fetches meta/latest and its own platform's bundle by them, so a rename would leave the nodes before it unable to update.

The desktop app is not on the mirror: you build it with Nix. See Install the desktop app.

The release key

Releases are signed with one minisign key, whose ID is 5D960652FE941432:

untrusted comment: minisign public key 5D960652FE941432
RWQyFJT+UgaWXQaBu5IkTRgPZjjYDNcCm4Sl6Wci0znLMDI0mJEoN3h2

The key is in the repository, built into every dassie binary, which trusts it alone for updates, and written into the installer. dassie verify-install names the key its binary trusts:

$dassie verify-install
…
Updates are verified with release key 5D960652FE941432.
Success! Dassie appears to be installed correctly.

The secret half is used only by the release workflow, for a version tag, and is never on a developer's machine or in CI.

What it protects against

The mirror and its HTTPS certificate are not trusted. A mirror can hold a release back, or offer an old one, but it cannot make your node install anything the key did not sign for that version, nor move it back to an older one. Only you can, by naming a version.

• SHA256SUMS is read only once its signature checks out.
• A bundle is unpacked only once it matches its signed sum, and only into a staging directory, which takes plain files and directories under dassie/ and nothing else.
• The new binary must name the version it was installed as, and pass dassie verify-install, before anything switches to it.

So you can use another mirror, with --mirror or DASSIE_MIRROR_URL, and still run only what the key signed. A mirror must be https://.

Rebuilding a release elsewhere, to check that it comes out byte for byte the same, is not there yet: the signature vouches for what the one release build made. What's next

Why it works this way

Checking a download by hand

The installer and the updater do this for you. To do it yourself, you need curl, minisign and sha256sum.

1. Find the version, or pick one:

   $VERSION=$(curl -fsS https://get.dassie.land/meta/latest)
   $echo $VERSION
   0.3.0

2. Download the sums, their signature and your platform's bundle:

   $for file in SHA256SUMS SHA256SUMS.minisig dassie-$VERSION-linux-x64.tar.gz; do curl -fsSO https://get.dassie.land/$VERSION/$file; done

3. Check the signature with the release key:

   $minisign -Vm SHA256SUMS -P RWQyFJT+UgaWXQaBu5IkTRgPZjjYDNcCm4Sl6Wci0znLMDI0mJEoN3h2
   Signature and comment signature verified
   Trusted comment: dassie 0.3.0

   The trusted comment must name the version you asked for. If it names another, or the signature does not verify, stop.

4. Check the bundle against its signed sum:

   $sha256sum --check --ignore-missing SHA256SUMS
   dassie-0.3.0-linux-x64.tar.gz: OK

Without minisign, the installer checks the same signature with OpenSSL 1.1.1 or later, reading minisign's format by hand; its verify_with_openssl shows how. To check a NixOS flake you locked, check its flake.tar.gz the same way; see Dassie on NixOS.