Verify what you install

Everything the installer trusts chains to root 1, the list of keys built into the script. Root 1 signs the next roots; the roots’ release keys sign the release index; the index names every release record and the installer’s own hash; each release record names every file by its SHA-256. The installer checks each link with ssh-keygen and installs nothing that does not check.

This website serves the script and the hash in the line that checks it, so a website that is not ours anymore could serve a tampered script and print that script’s hash next to it. Every check the script makes runs inside the script, so a tampered script can carry the real root 1, pass its own checks and skip the rest. The check that does not depend on this website is yours: compare the installer’s SHA-256 with the public trust record before you run it.

Where the installer’s hash is published

• The public trust record: the file ROOTS.txt in the public repository agent-labs-dev/warden-trust on GitHub, in commits we sign. At every index signing we add installer sha256 <hex> for the installer that index names; at each root ceremony, root <n> sha256 <hex>. Our deploy workflow refuses to ship an installer that record does not list, and changing that check needs code-owner review.
• Your invite and welcome e-mails. Each carries root 1’s SHA-256 as it was on the day it was sent: a second copy of root 1, as defence in depth.

A DNS record is not one of them: this site’s zone and its deploy sit with the same provider, so a record there would not be independent.

The record's line for the root this site's installer carries: root 1 sha256 1d8e266ee41595a8cf9f6d4c4bcfb721cbce2787b0d280038d67b61122a77fa5

How to compare it

1. Before you run the line, compare the 64-character hash in echo "<hash> install.sh" with the public trust record’s installer lines. If it is not listed, do not run the line. Root 1 is checked by that script, so it is only as good as that comparison.
2. The line also hands the script root 1’s SHA-256 (--root-sha256=), and the script stops with ROOT_PIN before it fetches anything if its own root 1 differs. After an install, shasum -a 256 ~/.local/share/warden/trust/root-*.txt prints the fingerprint of every root the install stored; root 1 should match the record and your e-mail. Both come from the script you compared in step 1, so they back that comparison up and never replace it.

If anything differs, do not run warden setup. Write to us, and include what you compared.

What else the installer checks

• Its own hash. Run as a file (the pinned line), the script compares its SHA-256 with the installer line of the signed index and stops with INSTALLER_MISMATCH if they differ. Piped to sh, it cannot, and says so. This runs inside the script, so it catches a stale or mixed-up download, not a tampered one.
• The release’s age. It installs a stable release only once it is 72 hours old, so a bad release can be caught and withdrawn first; --now waives only that wait.
• The signatures. Each record needs the number of signatures its root asks for, from keys it lists. At the end the installer prints which keys signed and the class of each key.