Verify your Linux download

Sonoran CAD, CMS, Radio and Studio use separate release signing keys. Download the AppImage, latest-linux.yml, SHA256SUMS-linux and SHA256SUMS-linux.asc from the same product version in Sonoran Desktop Apps.

Public keys and primary fingerprints

• CAD public key
  7B432CB92EC2A7F24C9ACA6B081A1D0F144ED844
• CMS public key
  0BFD9CE5E7E4CEBF199484C2925E943ECB82EB4D
• Radio public key
  EEDBB2BF46AB503729BF782C25AC62AC6B3F2217
• Studio public key
  A9725A28F312A484D503067D1FAD03A135DBAEB5

The signing subkeys expire September 9, 2028 (UTC). Full key and subkey fingerprints.

Check the signature and files

Install GnuPG using your distribution's package manager. In the directory containing the downloaded files, use the matching product key. For CAD:

gpg --import sonoran-cad-linux-public.asc
gpg --fingerprint 7B432CB92EC2A7F24C9ACA6B081A1D0F144ED844
gpg --verify SHA256SUMS-linux.asc SHA256SUMS-linux
sha256sum --check SHA256SUMS-linux

Compare the full primary fingerprint with this page. Proceed only if the signature is good and both checksum checks report OK. A warning that the imported key is not locally certified is separate from signature validity; verify the fingerprint instead of blindly trusting a downloaded key.

These detached signatures support manual verification. The current AppImage automatic updater uses HTTPS and the manifest's SHA-512 checksums; it does not automatically enforce the detached GPG signatures.

Back to downloads