Verifying downloads

Every xin package and tarball is signed with one RSA 4096 key.

C3A0 3E51 9874 C884 5DF8  D0FA FB73 0107 592F F47E

apt and dnf

signed-by/gpgcheck already do this for you on every install — the commands on the releases pageenable it. Nothing further to run.

Tarballs

curl -fsSLO https://dl.xinproxy.com/xin/latest/SHA256SUMS
curl -fsSLO https://dl.xinproxy.com/xin/latest/SHA256SUMS.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

The armoured key is atkeys/xin-archive-keyring.asc, the dearmoured one atkeys/xin-archive-keyring.gpg. RPM metadata carries the same key athttps://rpm.xinproxy.com/keys/xin-archive-keyring.asc.