Kit

The kit is signed.Verify it before you unpack it.

The VARI qualification kit is delivered as a tarball with a manifest, and the manifest is signed with the key below. An operator verifies four things before unpacking: that this key's fingerprint matches what is printed here, that the manifest's signature verifies against this key, that the delivered files match SHA256SUMS, and that the tarball matches the signed manifest. If any of the four fails, stop and tell VARI; do not unpack.

Signing key

Ed25519 public key

Key file
vari-kit-signing.pub.pem
Fingerprint
0b0f7214b42f55c5637eafc648c11a736fd72a8e056d0d07efaa94544aeccf6e
SHA-256 of the key in DER form. Compare it character by character with the file you downloaded.
Key
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEA1Jelw55B9/QaLav+rXUR/3j5ngxuO6iOAiGvgWsyVTA=
-----END PUBLIC KEY-----
In force
From September 2026. A replacement key, if ever issued, is announced on this page and signed by this one.
Verification

Four commands, in this order

Run these on the host that will unpack the kit, in the directory holding the four files VARI delivered: vari-kit-v1.tar.gz, MANIFEST.json, MANIFEST.json.sig and SHA256SUMS, plus the key file from this page.

1. Fingerprint
openssl pkey -pubin -in vari-kit-signing.pub.pem -outform DER | sha256sum
Must print the fingerprint above.
2. Signature
openssl pkeyutl -verify -pubin -inkey vari-kit-signing.pub.pem -rawin -in MANIFEST.json -sigfile MANIFEST.json.sig
Must print Signature Verified Successfully.
3. Contents
sha256sum -c SHA256SUMS
Every line must read OK.
4. Tarball against the signed manifest
python3 -c "import json,hashlib;m=json.load(open('MANIFEST.json'));h=hashlib.sha256(open(m['tarball']['name'],'rb').read()).hexdigest();print('tarball matches the signed manifest' if h==m['tarball']['sha256'] else 'MISMATCH')"
Must print tarball matches the signed manifest. SHA256SUMS is a convenience; the manifest is what the signature covers, so this is the check that binds the tarball to the key.

The kit re-checks every file against the signed manifest each time it runs, so a modified file stops the run before anything else happens. The runbook delivered with the kit contains these same four commands; if the two ever differ, this page is wrong and the runbook is right, and we would like to hear about it.