mirror of https://github.com/Anon-Planet/thgtoa.git synced 2026-08-04 18:15:03 +02:00

Files

T

nopeitsnothing 8b4542f4d9 site!(design): do it better

This redesign isn't final, but it is much more clean and responsive.

2026-06-27 17:15:40 -04:00

4.4 KiB

Raw Blame History

title, description, hide, schema

title

description

hide

schema

Verify

Verify the authenticity and integrity of Anonymous Planet releases.

toc

@context	@type	@id	name	url	logo
https://schema.org	Organization	https://anonymousplanet.net/	Anonymous Planet	https://anonymousplanet.net/verify/	../media/profile.png

Never blindly trust anything you download.

Verify ReleasesSignatures. Hashes. Trust nothing blindly.

Every release is GPG-signed and hashed. Verify before you read.

Quick Verification Import Our Keys

What We Publish

PDF Guide

thgtoa.pdf and thgtoa-dark.pdf — the full guide in light and dark mode. The only canonical single-file export.

Latest release

Detached Signatures

.asc files for every PDF and hash file, signed with the Release Signing Key (RSK). Verify with gpg --verify.

Our keys

Hash Files

sha256sums.txt and b2sums.txt for integrity. Both are also signed. Check with sha256sum -c or b2sum -c.

Manual steps

Quick Verification

Using the Python Script (Recommended)

# Verify everything — hashes, signatures, and optionally VirusTotal
python scripts/verify_pdf.py --all

# Hashes only
python scripts/verify_pdf.py --hashes

# GPG signatures only
python scripts/verify_pdf.py --signatures

# VirusTotal scan status (requires VT_API_KEY env var)
python scripts/verify_pdf.py --vt

Manual Verification

1. Import the key

gpg --import pgp/anonymousplanet.asc

Verify the fingerprint against our PGP page and GitHub releases before trusting it.

2. Verify the PDFs

gpg --verify export/thgtoa.pdf.asc      export/thgtoa.pdf
gpg --verify export/thgtoa-dark.pdf.asc export/thgtoa-dark.pdf

Expected output:

gpg: Signature made Sun 31 May 2026 03:23:26 AM EDT
gpg:                using EDDSA key C3023DBEA3FB38C438BA1EEDCEC60AEDE8B992A2
gpg: Good signature from "Anonymous Planet Release Signing Key" [ultimate]
Primary key fingerprint: C302 3DBE A3FB 38C4 38BA  1EED CEC6 0AED E8B9 92A2

!!! note "About the WARNING" WARNING: This key is not certified with a trusted signature is expected. It means the key has not been co-signed by another key in your web of trust — not that the signature is invalid.

3. Check hashes

=== "Linux / macOS"

```sh
sha256sum -c sha256sums.txt
b2sum     -c b2sums.txt
```

=== "Windows (PowerShell)"

```powershell
Get-FileHash -Algorithm SHA256 export\thgtoa.pdf | Select-Object Hash
# Compare with the value in thgtoa.pdf.sha256
```

4. VirusTotal (optional)

export VT_API_KEY=your_vt_api_key
python scripts/verify_pdf.py --vt

Or open the VirusTotal report URLs listed in the release notes directly.

Troubleshooting

"Good signature" but wrong owner? Ensure you imported the correct key from pgp/. Check the fingerprint matches the RSK: C302 3DBE A3FB 38C4 38BA 1EED CEC6 0AED E8B9 92A2.

Hash mismatch? Re-download the file. Verify you are using the correct hash file for the edition (light vs dark). Check for disk errors.

GPG not installed?

Platform	Command
Debian / Ubuntu	`sudo apt install gnupg`
RHEL / Fedora	`sudo dnf install gnupg2`
macOS	`brew install gnupg`
Windows	Gpg4win

4.4 KiB Raw Blame History