1. Get the files.
From the v0.0.8 release: the archive for your platform, plus SHA256SUMS and SHA256SUMS.sig. The install script downloads the same files and performs these checks for you.
2. Verify the signature.
The release key is pinned in install.sh. It signs SHA256SUMS; the archive must match the file. Nothing else needs to be trusted.
Key: invincible-release ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/0fXPq1j51BcfGY0Jp9QfPGy6kHVQQ+W282VFPR/Qo
Signature asset: SHA256SUMS.sig · checksums: SHA256SUMS
3. Check the provenance.
The release workflow publishes a Sigstore build attestation. With the GitHub CLI signed in, the archive can be tied to the workflow and the commit that produced it.
4. Know what “reproducible” means.
Before publishing, the Linux x86_64 archive is built a second time on another machine. If the bytes differ, the workflow refuses to publish. To check it yourself, build the tagged commit from a clean source tree with the flags in release.yml and compare the archive.
Reproducibility is a property of the Linux build, not a promise about every platform. The macOS build is attested and signed but not claimed to be byte-reproducible.
5. The install script you actually run.
This site serves a verbatim mirror of the upstream script at /install.sh. Its hash is recorded at build time, and the byte count is shown below. The command on the install page uses this domain, not raw.githubusercontent.
6. The runtime record.
The supply chain ends when the binary runs. From there, the node’s own records take over: every request gets an Ed25519-signed receipt, every receipt is chained into audit.jsonl, and invincible audit --verify checks both the chain and the signatures.
What verification does not prove.
- It does not prove the code is free of bugs or malice. It ties the bytes to a key and a build.
- Invincible v0.x has not had an independent security review. The project says so on its own pages.
- A correct signature with a key you did not intend to trust proves only that the signer signed. Compare the key with the one pinned here and in the installer.