PandaLink Edge

Release Signing Key

The public half of the Ed25519 key that signs PandaLink Edge release artifacts. This page is the out-of-band distribution channel: download the key here, compare its fingerprint with the one recorded in the signed manifest, and only then trust it.

Key id

pandalink-release-ed25519-v1

Algorithm

Ed25519 (SPKI DER, base64)

Fingerprint (SHA-256 of the raw SPKI DER bytes)

sha256:d0ee84b7125abc311bca5bd8405ca2d199d5f86ac0f9e20581965c6312cdf1ab

Download

public-key.pem — PEM-armored public key
public-key.json — machine-readable metadata

Verify a release

Every release bundle ships public-key.pem and verify-release.mjs alongside the artifact, so you can verify with no network access and nothing installed:

tar -xzf pandalink-edge-v1.0.0-final.tar.gz
cd pandalink-edge-v1.0.0-final
node verify-release.mjs
# Expected: "=== VERIFICATION: 7/7 checks PASS ==="

The script uses only Node's standard library — no npm install, no cosign, no jq. It confirms that the key is the pinned PandaLink release key, that the detached signature verifies over the exact bytes of manifest.json, and that the tarball hashes to the digest recorded in that signed manifest. It also runs two negative controls, so a check that accepted everything would fail.

Compare the fingerprint yourself

Do not trust this page on its own. The signature is what binds the key to the artifact. To check the key you downloaded against the manifest that was signed:

# The fingerprint recorded in the SIGNED manifest
grep public_key_fingerprint manifest.json

# The fingerprint of the key you downloaded
openssl pkey -pubin -in public-key.pem -outform DER | sha256sum

Both must print d0ee84b7125abc311bca5bd8405ca2d199d5f86ac0f9e20581965c6312cdf1ab.

The private half of this key is never published. It is held outside the source repository by the release operator and never enters a build, a bundle, a log, or a CI artefact. If you are ever asked for it, the request is not from PandaLink.

Report a problem

If a release fails verification, do not install it. Report it to [email protected] with the output of the verification script, and to [email protected] for anything else.