# Verifying an Ouli Redact download

Every installer here is signed with [minisign](https://jedisct1.github.io/minisign/)
and listed in `SHA256SUMS`, which is signed too. The public key is published
out of band (build/release-signing/oulution-release.pub in the source
repository); the copy in this folder is for convenience — compare it.

Public key (base64):

    RWSXGhIyTnwDr7Uk5Cmvg9wmVu7ISYKiXWE4/JGsonqggev2EcX5EtmB

Verify a file (prints the signed comment: product, version, commit, date):

    minisign -Vm "<installer>" -p oulution-release.pub

Verify the checksum list and every artifact against it:

    minisign -Vm SHA256SUMS -p oulution-release.pub && sha256sum -c SHA256SUMS

Windows PowerShell without minisign (integrity only, no authenticity):

    Get-FileHash "<installer>" -Algorithm SHA256   # compare with SHA256SUMS

A failed check means the file is not what Oulution built — do not install it.
Signed: oulution-desktop 0.1.0 e94d976 2026-09-11T08:55:12Z