You can verify the integrity and authenticity of a DyScan release, which assures you that you are using the original, unmodified files that we released. Steps are described below.
Install GnuPG
Download is available under "binary releases" section here:
Alternatively if you are using Homebrew on Mac OS, you can run this command:
brew install gnupg
Get our public key
You will need our public key to verify the signature. Here is the key:
The public key has been updated on March 22, 2024.
Save it to a file (ex. dyneti.gpg) and run this command to import the key:
gpg --import dyneti.gpg
Checksums and signatures
After getting the access token for Dyneti's repo access, go to any temporary directory outside your project directory and clone our repository with the following terminal commands:
When asked for a password for user "dyscan", paste the access token that we provided.
Checksums and signatures are available in the same directory as your chosen release version.
Verify Android
Go to your dyscan.aar file location and ensure the checksum and signature files are there.
Run this command to generate checksum for your local copy of dyscan.aar and compare with our checksum:
$ shasum -c dyscan.aar.sig
The command produces an output with OK, it means that the checksums are matching.
dyscan.aar: OK
If you've imported our public key, you can verify the signature of the checksum using this command:
gpg --verify dyscan.aar.sig dyscan.aar.sha256
The command will output the signature date, RSA key, creator info and verification result: good or bad signature.
gpg: Signature made Fri Mar 20 21:11:08 2020 CET
gpg: using RSA key 9651699E6D0A65FA229E6E85A5C99B1BF398E5A6
gpg: Good signature from "Dyneti Technologies, Inc. <team@dyneti.com>" [ultimate]
Verify iOS
Go to your DyScan.xcframework location and ensure the checksum and signature files are there.
Run this command to generate checksum for your local copy of DyScan.xcframework and compare with our checksum:
The command will output the signature date, RSA key, creator info and verification result: good or bad signature.
gpg: Signature made Fri Mar 20 21:11:08 2020 CET
gpg: using RSA key 9651699E6D0A65FA229E6E85A5C99B1BF398E5A6
gpg: Good signature from "Dyneti Technologies, Inc. <team@dyneti.com>" [ultimate]
