Hi everyone, I’ve released Verify 1.0, an open-source app for Passport Prime. It lets you check a downloaded app, firmware image, or other release file on a separate device instead of relying solely on the computer that downloaded it.
Verify calculates SHA-256 and SHA-512 hashes, compares common checksum files, and checks OpenPGP signatures over checksum files or release files. You can save publisher public keys for future checks. It works with files on internal storage, Airlock, SD cards, and USB drives.
Everything happens locally. Verify has no network access, cannot access your master seed or Seed Vault, and never runs the files it checks.
To install: You need KeyOS 1.4 or newer. Get the app package and QnA publisher certificate from the v1.0 release. Allow the certificate in Settings > Apps, then install the .app file. This is a QnA-signed third-party app, not a Foundation-signed app, and it has not had an independent security audit.
A matching hash means the bytes match. A valid signature means a particular key signed them. Neither proves the software is safe or that the key belongs to its claimed owner.
App Showcase · Download and test files · Source and full instructions
I’d welcome feedback, especially examples of release formats Verify doesn’t yet handle. Please don’t share private keys, recovery words, or sensitive files in the thread.