Verify what you received

Every release is signed. Before installing it, verify the jar and compare the signer against the fingerprint published here over HTTPS.

1. Verify the jar signature

Run the command for the product jar inside the downloaded package:

jarsigner -verify -verbose -certs code/jars/cxaudit.jar | grep -A2 "Signed by"

jarsigner -verify -verbose -certs code/jars/quality.jar | grep -A2 "Signed by"

jar verified is an integrity result, not an identity result. It means the archive has not changed since it was signed. It does not by itself mean Centipod signed it; jarsigner prints that line for a jar signed by anybody, including somebody who altered and re-signed it.

2. Compare the SHA-256 fingerprint

Use the fingerprint beside the exact build on your product profile. Published signing identities from the same downloads catalogue are shown below.

CxAudit

Published versions: 1.0.0

8A:06:54:E2:FC:77:A4:CB:8C:F9:CE:CB:89:DC:C8:8E:B1:FD:C7:24:99:50:E2:E1:0A:D0:7E:DE:F0:14:13:98

Fetch the fingerprint over HTTPS from a host you navigated to yourself—not from the email that carried the archive and not from a file inside it. Anyone able to alter the archive in transit could alter something that travelled with it.

If the archive does not verify, or verifies under a certificate you do not recognise, do not install it. Tell us.

Jar signing

Centipod produced this software

This is the claim established by verifying the release signature and matching its signer fingerprint.

Attestation

A licensed copy produced this result

This is a separate signature over product output, rooted through the public key carried by a licence.

The product never calls this portal

Licence verification is an offline signature check against public roots compiled into the jar. There is no activation callback, startup callback or revocation-list request. That is deliberate, including for air-gapped estates.