ITYES · Release verification
Verify the publisher.
Then run the package.
Speclara distribution signatures use a dedicated ITYES release key. A valid signature confirms the signed file and key; it does not guarantee the absence of defects or replace your deployment review.
Release-signing public key
Download public keyuntrusted comment: minisign public key 993B78E138DE4C85 RWSFTN444Xg7mQbI6a2gGAAJ1srwdla+atdDsHzFi/PcKbXbqnyKIEy6
Public-key file SHA-256: 768cedbda3ba0d737712df4f1bbb11532b920efdb9e5f7bd7cd64b240f5c66a2
On first use, authenticate the key through an ITYES contact channel you already trust. Fetching a key and signature from the same website alone does not protect against that website being compromised. Retain your verified public key for future releases.
Verify before extracting or installing
Install Minisign from its official distribution. Download the ZIP, its .minisig, the release manifest and its signature to one directory. Use your trusted public key:
minisign -V -p ityes-speclara.pub -m speclara-dependency-track-full-sandbox-2026.10.22-rc1.zip minisign -V -p ityes-speclara.pub -m release-manifest.json
Both checks must succeed. Compare the ZIP SHA-256 with the signed manifest, and check that it is the release you intended to install. Do not run files from an archive whose signature fails.
What is signed
The final ZIP and its release manifest are signed separately. The manifest records the archive hash, dependency lockfile and release documentation. Internal package integrity checks remain a separate step after extraction.
The signing private key is never included in a download, website deployment or MCP configuration. A local Node package signature is not Apple notarization or a native installer signature.
Key changes and security reports
Planned key changes will be announced here with a transition signed by the previous key. If a key is compromised, we will identify affected releases and publish recovery instructions through established ITYES channels.
Report a suspected release problem to [email protected]. Include the release version and file hash; do not send passwords, API keys or private signing keys.