Verifying binaries

runZero generates the Console, CLI, and Explorer download binaries dynamically. Dynamic binaries make it easy to deploy Explorers that connect back to the right organization, but they complicate independent integrity validation. Windows binaries have a valid Authenticode signature, and every binary also carries a secondary, internal signature. The runZero Verifier checks that signature: it confirms whether a given binary contains a valid internal signature, in addition to any existing Authenticode signatures.

Download the latest verifier from the bottom of this page, along with the PGP signature file for your architecture.

The runZero Verifier is always signed by PGP Key ID 60EBAAE9AEF08C6D.

To validate the signature of the Windows 64-bit Verifier, you need a GPG client. Then run:

C:\> curl -s https://www.runzero.com/.well-known/security.pub.asc | gpg --import
C:\> gpg --verify runzero-verifier-3.1.0-windows-amd64.exe.asc

A successful validation shows a valid signature by key ID 9B5DAFF7D43349298A3039BD60EBAAE9AEF08C6D.

gpg: Signature made Sun 07 Aug 2022 11:33:15 AM CDT
gpg:                using RSA key 9B5DAFF7D43349298A3039BD60EBAAE9AEF08C6D
gpg:                issuer "security@runzero.com"
gpg: Good signature from "runZero Security <security@runzero.com>" [unknown]

This warning is expected and does not mean the signature has a problem:

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.

With the Verifier itself validated, use it to check the signature of any runZero binary:

C:\> runzero-verifier-3.1.0-windows-amd64.exe runzero-explorer-3.1.0-windows-amd64.exe
runzero-explorer-3.1.0-windows-amd64.exe: VALID SIGNATURE

A failed validation shows the error Invalid or missing signature, and the verifier exits with status 1.

Binary downloads

Windows

Linux

Additional Linux builds

macOS

BSD variants

FreeBSD

NetBSD

Dragonfly

OpenBSD