Skip to content
StratumStratum Docs

Download and verify

Releases are published on the release mirror. latest/ always points at the newest release; each release also has its own folder, <version>/.

File What it is
stratum-x86_64.iso The installer ISO (about 4 GB). In a version folder it is stratum-<version>-x86_64.iso.
SHA256SUMS SHA-256 checksums of the ISO, the upgrade bundle and release.json.
SHA256SUMS.asc The GPG signature of SHA256SUMS.
stratum-release-key.asc The public GPG key that signs releases.
release.json The version, build date and file sizes.
stratum-<version>-bundle.tar The release as one file, for an offline upgrade.

Download

Section titled “Download”
Terminal window
BASE=https://mirror.stratum-labs.cloud/releases/stratum/latest
curl -fLO "$BASE/stratum-x86_64.iso"
curl -fLO "$BASE/SHA256SUMS"
curl -fLO "$BASE/SHA256SUMS.asc"
curl -fLO "$BASE/stratum-release-key.asc"

For a specific release, replace latest with its version, for example https://mirror.stratum-labs.cloud/releases/stratum/0.7.0/, and use the versioned ISO name.

Verify

Section titled “Verify”

  1. Import the release key and check its fingerprint against the one below. The key is served next to the files it signs, so this comparison is what proves the files come from the Stratum release key.

    Terminal window
    gpg --import stratum-release-key.asc
    gpg --fingerprint
    36CE F53B DF1D 45B7 D2D9  43DE AB42 ACA1 15BF 62AE

  2. Check the signature on the checksums:

    Terminal window
    gpg --verify SHA256SUMS.asc SHA256SUMS

    The output must say Good signature. A warning that the key is not certified with a trusted signature is normal for a key you have not signed yourself.

  3. Check the ISO against the signed checksum. SHA256SUMS names the ISO by its versioned file name, so compare the hash directly:

    Terminal window
    grep -- '-x86_64\.iso$' SHA256SUMS | awk '{print $1"  stratum-x86_64.iso"}' | sha256sum -c

    Expected: stratum-x86_64.iso: OK. On macOS use shasum -a 256 -c; on Windows, Get-FileHash stratum-x86_64.iso -Algorithm SHA256 and compare the hash by eye.

The release manifest (minisign)

Section titled “The release manifest (minisign)”

Inside the ISO and the upgrade bundle, stratum/payload/manifest.json lists every image and file of the release with its digest, and manifest.json.minisig signs it with the release’s minisign key. A node checks this signature itself before it installs or upgrades to a release, against the keys built into its own OS. To check it by hand, with the ISO mounted at /mnt:

Terminal window
minisign -V -P RWSR1PYSOQWffQrW3dGPoDKKt3nwu39+wOB81E5CHnpoQWcKFpeoCWGE \
-m /mnt/stratum/payload/manifest.json

The key ID is {minisignKeyId}. An installed node keeps the public keys it trusts in /usr/share/stratum/release-keys/.