Verify Agent releases before installation.
PassiveNode signs production Agent release manifests with a dedicated asymmetric release key. Easy Setup fails closed unless the downloaded release key matches the independently pinned fingerprint below.
Production release-signing key
Back to PassiveNodeSHA-256 fingerprint of the canonical SubjectPublicKeyInfo DER:
4d46511f5c6519bc1153cb48fd1d1bd6a30120462fc63c2eb376efe6cf043af8
This fingerprint is published here independently from the mutable Object Storage release feeds. Do not treat a fingerprint contained only in latest.json, latest-amd64.json, or latest-armhf.json as a trust anchor.
- The downloaded public key matches this pinned fingerprint
- The release manifest has a valid RSA/SHA-256 signature
- The manifest architecture matches the selected package
- The downloaded Debian package matches the signed SHA-256
A release-key change requires an explicit production pin update and an update to this page. Until both are deliberately changed, a new or unexpected key is rejected rather than silently trusted.