Verify PAI image
Three steps: hash the file, check the signature, trace the build. All client-side — nothing is uploaded.
1
File — SHA256 checksum🔒Computed entirely in your browser. The file never leaves your device.
Computed
Expectede55b5b3c9190f1dd465bcf8e3bd73d718505a5e83583d0a9ca28be3528085f4a
2
Signature — GPG verificationGPG signing is in progress — signature files will be available with the first stable release.
3
Transparency — build provenanceGitHub release — pai-amd64.iso v0.1.0CI/CD build workflow run
Why should I trust this?
PAI images are built by a public CI/CD pipeline on GitHub Actions. You can:
- Inspect every line of the build scripts
- Re-run the workflow yourself on your own GitHub account
- Compare the SHA256 hash of your locally-built image to the released one
- Verify the GPG signature against a key whose fingerprint is published in the repo
If the SHA256 in Step 1 matches and the GPG signature in Step 2 is valid, you have cryptographic proof the file you downloaded is identical to what the build pipeline produced — byte for byte.