Verify your download

Every Winner AI server bundle, winner-ai-server-<X.Y.Z>.tar.gz, carries a SHA256SUMS file listing every file inside it and SHA256SUMS.sig, a signature over that list made with the Winner AI release key. Checking the signature against the key below, and then every file against the list, proves the bundle is the one we released. This page is published on its own, apart from the bundle and from any e-mail that brought you the bundle, so the key you check against does not come by the same channel as the bundle.

The release key

Its fingerprint is:

SHA256:EKI6sQilBqVmM1HZ/jNEamMFhDX7GcJWl0ykl69k2hs

Write the key out and print its fingerprint; the second command must print the fingerprint above:

keys=$(mktemp -d)   # outside what the archive unpacks into
printf '%s\n' 'winner-release namespaces="release@getwinner.com" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMMDttCgimgvdz/6/0q4s5TC8RLUg783EsuPF4AGF0nW' > "$keys/allowed_signers"
awk '{print $3, $4}' "$keys/allowed_signers" | ssh-keygen -lf -

Where it prints anything else, or where the fingerprint your Winner AI contact gave you differs from this one, stop and load nothing from the bundle.

Check the bundle

In the folder that holds the archive:

mkdir winner-install && tar --no-same-owner --no-same-permissions -xzf winner-ai-server-<X.Y.Z>.tar.gz -C winner-install
cd winner-install/winner-ai-server-<X.Y.Z>
ssh-keygen -Y verify -f "$keys/allowed_signers" -I winner-release -n release@getwinner.com \
  -s SHA256SUMS.sig < SHA256SUMS &&
sha256sum --check --strict --quiet SHA256SUMS   # prints nothing when every file matches

ssh-keygen must print a line that starts Good "release@getwinner.com" signature for winner-release, and sha256sum must print nothing. Anything else means the bundle is not the one we signed: stop, and load nothing from it. Ask your Winner AI contact for the bundle again.

These are the commands of step 2 of Installing the Winner AI server, which says why each one looks as it does and what to run next.

This guide as one file

The whole guide on this site, for the release it describes, is also one PDF: the same pages, in the same order, as the PDF inside the bundle.