Korzen
EN
Sign inStart free
Bot Protection
In these docs

Verify a download

Check that the SDK package you installed is the one Korzen released, against its signed SHA256SUMS and Korzen's release key.

Every SDK release comes with a SHA256SUMS of the files it published, signed with Korzen's release key. Check the signature first, then your download against the sums.

The key

The public key is at /bot-protection/sdk/signing-key.asc. The same key signs the Java SDK on Maven Central, so its fingerprint can be compared there too, apart from this site.

curl -fsSO https://korzen.dev/bot-protection/sdk/signing-key.asc
gpg --show-keys signing-key.asc

The sums

A release's sums and their signature are at /bot-protection/sdk/releases/<sdk>/v<version>/, the SDK being node, python, java, go, php or dotnet. Fetch them beside the file you check, verify the signature against that key alone, then the file. For the Node SDK:

V=2.1.0
curl -fsSO https://korzen.dev/bot-protection/sdk/releases/node/v$V/SHA256SUMS
curl -fsSO https://korzen.dev/bot-protection/sdk/releases/node/v$V/SHA256SUMS.asc
gpg --dearmor --output korzen.gpg signing-key.asc
gpgv --keyring ./korzen.gpg SHA256SUMS.asc SHA256SUMS
npm pack @korzen/bot-protection@$V
sha256sum -c --ignore-missing SHA256SUMS

gpgv must say "Good signature", and sha256sum must say OK for your file. Anything else means the file is not the one Korzen released: do not install it, and write to us.

Each SDK's file

  • Node: npm pack @korzen/bot-protection@<version>, the tarball npm serves.
  • Python: pip download korzen-bot-protection==<version> --no-deps.
  • Java: the jar of dev.korzen:bot-protection from Maven Central.
  • Go: the version's .zip, .mod and .info from Korzen's Go proxy, under /goproxy/; the go command also checks them against Go's checksum database.
  • PHP: the files Composer installed in vendor/korzen/bot-protection, which the sums name under package/.
  • .NET: nuget.org adds its own signature to every package, so its .nupkg differs from the one the sums cover. Check it with dotnet nuget verify --all instead.