Verifying Aembit binary release signatures

Aembit cryptographically signs all binary releases which enables you to cryptographically verify the authenticity of those releases.

To verify binary release signatures, Aembit suggests using gpg and shasum to verify GPG signatures and file integrity.

Prerequisites

Before verifying binary release signatures, you must:

• Have gpg (GNU Privacy Guard) installed.

  Expand to see steps to install gpg

  To install gpg, select a tab for your OS and follow the instructions:

  Linux/WSL

  Debian:

  apt install gnupg

  RHEL:

  yum install gnupg2

  MacOS

  brew install gnupg

  Windows

  PowerShell:

  winget install GnuPG.GnuPG

  Chocolatey:

  choco install gpg4win

  Or, if you’re using WSL, follow the Linux/WSL tab’s instructions.

• Have shasum installed. shasum is pre-installed on most operating systems.

• Import Aembit’s public GPG key (you must have gpg installed for this command to work):

  curl "https://keybase.io/aembit/pgp_keys.asc" | gpg --import

Available releases

• Aembit CLI
• Agent Controller
• Agent Proxy
• MCP Identity Gateway

Each release page lists every version, platform, and architecture, with the expected SHA-256 and copy-ready verification steps generated from the release itself. See Prerequisites for the concepts, then visit the release page for the exact commands for your download.