The Carbide project

carbide-install.exe - sha256 64546d0bb6207734b2c6fce7857b656a5f3b101b2d24ec845ec73cf5f0161bfa

carbide-install.exe.sig - detached Ed25519 signature of carbide-install.exe. Download this file and put it in the same folder as the installer. It is used to verify that the installer is authentic.

On Windows, open PowerShell in the folder with the downloaded file. True means the hash matches:

(Get-FileHash -Algorithm SHA256 -Path .\carbide-install.exe).Hash -eq "64546d0bb6207734b2c6fce7857b656a5f3b101b2d24ec845ec73cf5f0161bfa"

To check the signature the OpenSSH Client is required.
It is already included in Windows 10 and 11.
If ssh-keygen is not found, enable OpenSSH Client under

• Settings -> Apps -> Optional features on Windows 10
• Settings -> System -> Optional features on Windows 11

The public key for this check is the DNS TXT record _sign.carbide-x64.org. The installer and carbide-install.exe.sig are files on this web server. The key is not. A takeover of the server and replacement of those files does not replace the key, so a signature made by another key does not match. The AD flag means the DNS answer was authenticated with DNSSEC.

A matching signature prints Good "file" signature for carbide:

$resp = Invoke-RestMethod -Uri "https://cloudflare-dns.com/dns-query?name=_sign.carbide-x64.org&type=TXT" -Headers @{ Accept = "application/dns-json" }
if (-not $resp.AD) { throw "DNSSEC AD flag is missing" }
$txt = ($resp.Answer | Where-Object { $_.type -eq 16 } | Select-Object -First 1).data.Trim('"')
"carbide $txt" | Set-Content -Path allowed_signers -Encoding ascii
cmd /c "ssh-keygen -Y verify -f allowed_signers -I carbide -n file -s carbide-install.exe.sig < carbide-install.exe"