Verify the agent download¶

What is signed, and how to check it¶

Artifact	Signature	Check
macOS `.pkg`	Apple Developer ID, notarized	`pkgutil --check-signature`
Windows `.msi` / `.exe`	Authenticode, publisher Hodeitek S.L., timestamped (since `2.12.1`)	`Get-AuthenticodeSignature`
Linux tarball and binary	No OS-native signature. Covered by the Hodei-Shield release signature (Ed25519)	steps below
Every file, every OS	`SHA256SUMS` lists every published file, and `SHA256SUMS.sig` is its Ed25519 signature	steps below

A checksum on its own proves nothing about who made a file, because a file and its checksum come from the same place. The signature on SHA256SUMS is what ties your download to Hodeitek. Check it on every OS, before installing.

The release public key¶

Save these three lines as hodei-shield-release.pub.pem:

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAEUqKd+ot7BESwk+vf6EVBKudMi6F6jmY3dJeHXfCWkQ=
-----END PUBLIC KEY-----

It is an Ed25519 public key. Its raw 32 bytes are, in base64, EUqKd+ot7BESwk+vf6EVBKudMi6F6jmY3dJeHXfCWkQ=, and the SHA-256 of those 32 bytes is 8b730d2fcbd90e2656bd9b3f265638f1e8e8ac2379d48b0636feb5efe5a88f07. Obtain the fingerprint a second time through a channel other than the one you got this guide from (for example, ask Hodeitek support by e-mail), and compare. If the two ever differ, stop and ask Hodeitek support. You can compute the fingerprint of the key file you saved:

openssl pkey -pubin -in hodei-shield-release.pub.pem -outform DER | tail -c 32 | sha256sum
# 8b730d2fcbd90e2656bd9b3f265638f1e8e8ac2379d48b0636feb5efe5a88f07  -

That command prints the value above for the key as printed on this page.

How the release key is kept. The private half of the release signing key is not in a hardware security module (HSM). It is held as a secret of the release CI environment, which signs each release, with an encrypted backup; an earlier copy on a workstation was deleted, and its destruction cannot be confirmed. The signature proves the files come from whoever controls this key; it does not say how well the key is guarded. If you need an HSM-grade guarantee, ask Hodeitek support before installing.

The check (OpenSSL 3 or later)¶

Example with the files of release 2.14.1 on Linux (OpenSSL 3), verified on 2026-10-15: step 1 printed 64, step 2 printed Signature Verified Successfully (exit 0), step 3 printed hodei-shield-2.14.1-linux-x86_64-musl.tar.gz: OK (exit 0).

In the folder holding SHA256SUMS, SHA256SUMS.sig, your download and the key file:

# 1. The signature file is ONE LINE of base64. Decode it; it must be 64 bytes.
openssl base64 -d -A -in SHA256SUMS.sig -out SHA256SUMS.sig.raw
wc -c < SHA256SUMS.sig.raw                      # must print 64

# 2. Verify SHA256SUMS against the release key.
openssl pkeyutl -verify -rawin -pubin -inkey hodei-shield-release.pub.pem \
  -sigfile SHA256SUMS.sig.raw -in SHA256SUMS
# good:  Signature Verified Successfully      (exit 0)
# bad:   Signature Verification Failure       (exit 1) -> do NOT install

# 3. Only now check your file against the verified list.
sha256sum --ignore-missing -c SHA256SUMS        # your file must say: OK

--ignore-missing is there because SHA256SUMS names every published file and you hold one or two. If your file is not listed, or says FAILED, delete it. Anything other than the exact "Signature Verified Successfully" line means do not install; download again, and if it repeats, tell Hodeitek.

What a failure looks like. With one byte of a copy of SHA256SUMS changed, step 2 prints Signature Verification Failure (preceded by an error:...provider signature failure line) and exits 1. With a valid SHA256SUMS and one byte of the download changed, step 3 prints <file>: FAILED, then sha256sum: WARNING: 1 computed checksum did NOT match, and exits 1. Either means: delete the files, do not install.

On macOS, /usr/bin/openssl is LibreSSL and fails with an "unrecognized flag" error; use OpenSSL 3 by full path.