Verify a release

Every file on downloads.nexpanel.app is signed with the NexPanel release key (Ed25519). The private key is kept offline; the download server only holds public files.

The release key#

Public key:   https://downloads.nexpanel.app/keys/nexpanel-release.pub
Fingerprint:  471253db7961a1b2554230e7ba8e65f53805d1f88d45328e1b5826274199e6da

The fingerprint is the SHA-256 of the key in DER form:

openssl pkey -pubin -in nexpanel-release.pub -outform DER | sha256sum

Compare it with the fingerprint on this page and on a second source you trust before relying on it.

Check any file#

Each file has a signature next to it with .sig added to the name:

curl -fsSO https://downloads.nexpanel.app/control/v1.0.4/nexpanel-controller-1.0.4.tar.gz
curl -fsSO https://downloads.nexpanel.app/control/v1.0.4/nexpanel-controller-1.0.4.tar.gz.sig
openssl pkeyutl -verify -pubin -inkey nexpanel-release.pub -rawin \
    -in nexpanel-controller-1.0.4.tar.gz -sigfile nexpanel-controller-1.0.4.tar.gz.sig

Checksums and the manifest#

To check a download against the signed checksum list:

curl -fsSO https://downloads.nexpanel.app/checksums/SHA256SUMS-1.0.4
curl -fsSO https://downloads.nexpanel.app/checksums/SHA256SUMS-1.0.4.sig
openssl pkeyutl -verify -pubin -inkey nexpanel-release.pub -rawin -in SHA256SUMS-1.0.4 -sigfile SHA256SUMS-1.0.4.sig
grep nexpanel-controller-1.0.4.tar.gz SHA256SUMS-1.0.4
sha256sum nexpanel-controller-1.0.4.tar.gz

What NexPanel checks automatically#

• The installer verifies the manifest (or checksum list) and every package before running it.
• The controller shows an update only when the manifest's signature matches the key, and ignores a manifest older than one it has already seen.
• Each agent downloads the package itself and checks its SHA-256 and signature with the key compiled into the agent.
• The controller updater (root) downloads the manifest and the package again and checks both before installing.