Release signing keys

AcTree signs every self-hosted release published since 20 October 2026, so you can check that what you run is what we published. This page lists the keys we sign with. It is served from actree.ai, separately from the AcTree Portal that serves the downloads, so you can compare a fingerprint against a second source before trusting a file.

Current key

Key name: actree-selfhost-release-2026-10. Algorithm: Ed25519. Status: active since 20 October 2026.

It signs the self-host release inventory (bundle.json, which lists the SHA-256 of every file in the release) and the one-command installer, actree-install.py.

Fingerprint (SHA-256 of the DER-encoded public key):

2dd371a3b48d5590b6f11aa2f0a83e6588c3c3d8fed2df726405bcdac730ec49

Public key:

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEA6Yq0ZRHZr7sHSG+qPqWD5sen8hRb1xkdREWt+EObfqg=
-----END PUBLIC KEY-----

Verify the installer before running it

Download the installer, its signature and the public key from the Portal:

curl -fsSLO https://portal.actree.ai/downloads/actree-install.py
curl -fsSLO https://portal.actree.ai/downloads/actree-install.py.sig
curl -fsSLO https://portal.actree.ai/downloads/actree-selfhost-release-2026-10.pub.pem

Then run this block on the server. It starts the installer only if the key’s fingerprint matches this page and the signature verifies:

test "$(openssl pkey -pubin -in actree-selfhost-release-2026-10.pub.pem -outform DER | sha256sum | cut -d' ' -f1)" = 2dd371a3b48d5590b6f11aa2f0a83e6588c3c3d8fed2df726405bcdac730ec49 \
  && openssl pkeyutl -verify -pubin -inkey actree-selfhost-release-2026-10.pub.pem -rawin -in actree-install.py -sigfile actree-install.py.sig \
  && python3 -I actree-install.py

The installer then verifies the release’s signature and every file’s SHA-256 with the same key, which it carries built in, before it runs anything from the download. OpenSSL 3.0 or newer is required.

Rotation and revocation

A new key is listed here as “next” at least 14 days before the first release it signs. A key that must no longer be trusted is marked “revoked” here first, with the time of revocation and the last release known to be good; its signatures are never accepted again, and its replacement is used at once, without the 14-day notice. Revoked keys: none.