Verify a download

A GADNET router performs these checks automatically. The steps below repeat them by hand for a manifest or bundle you already have - for example one copied from your own router - without relying on this server.

1. Release public key

Use the copy stored on your own router, /etc/gadnet/release-public-key-slhdsa.pem, and compare its fingerprint with the key set on the Keys page. Do not take the key from the same place as the file you are checking: a key and a file from one compromised source always verify against each other.

2. Signature

openssl pkeyutl -verify -pubin \
    -inkey release-public-key-slhdsa.pem \
    -rawin -in manifest.json \
    -sigfile manifest.json.slhdsa.sig

openssl pkeyutl -verify -pubin \
    -inkey release-public-key-slhdsa.pem \
    -rawin -in pakiet.tar.gz \
    -sigfile pakiet.tar.gz.slhdsa.sig

These examples are for a Linux shell (also WSL on Windows), with OpenSSL 3.5 or newer. Replace the example filenames with your own. Verify the manifest first, then the bundle. A valid signature prints Signature Verified Successfully; on failure, do not use the file. A valid signature confirms origin, not the absence of bugs or vulnerabilities.

3. Bundle digest and size

sha256sum pakiet.tar.gz
wc -c < pakiet.tar.gz

Compare the bundle digest and byte count with its sha256 and size fields in the verified manifest. This step concerns the bundle, not a checksum of the manifest stored inside itself. Do not trust checksums from an unverified document.

Release files are served only to GADNET routers, so they cannot be downloaded from this site with a browser or curl. The commands above apply to files you already have, for example ones copied from your router.

Update server address on the router

# /etc/gadnet/system.conf
UPDATE_MANIFEST_URL=https://updates.gadnet.pl/v1/manifest.json

Routers use this address by default. Changing it does not weaken the protection: another server can deliver bytes but cannot produce a valid signature, so the worst outcome of a wrong address is a failed update. The address must use HTTPS, and the router rejects any other, because plain HTTP would reveal which version a device runs and make withheld updates harder to notice.

What verification does not tell you

A valid signature proves that a release came from the GADNET release process. It does not prove that the release is current: a server that keeps serving last month's signed manifest withholds updates while every signature still verifies. To limit this, the router refuses a manifest whose generated time is older than the last one it accepted or, by default, older than 90 days, and the admin panel shows the time of the last successful check. If that time stops advancing, updates are not reaching the router.