Verifiable releases: checksums + signatures + the reproducible-build claim

• Type: feature (release engineering / supply chain)
• Track: A (core — owns the build + the self-host gate)
• Status: backlog — opened 2026-07-12.
• Owner: —
• Related: [[feature-web-track-w-bootstrap]] (the download page consumes this)

Why (this is the REAL anti-impersonation defense)

A clone of the website harms nobody by existing. What harms people is a trojaned pxx binary served from a page that looks like ours. Source secrecy does nothing against that — verifiability does:

• A phishing clone can copy our page. It cannot make its binary match a hash published somewhere it doesn't control.
• So: releases and checksums live in the PUBLIC repo (GitHub Releases), installers point at the canonical GitHub URL, and the checksums are published where a clone site cannot rewrite them. Publicness is the security property here, not a liability.

The claim only we can make

We have a byte-identical self-host fixed-point gate. That means we can credibly say: build it yourself and get the same bytes. A reproducible build is an impersonation defense no clone can match, and it is nearly free for us — the gate already proves determinism. Nobody shipping a compiler gets to say this as easily as we do; say it loudly on the download page.

Scope

1. SHA256SUMS for every release artifact, generated by the release job, committed/attached to the GitHub Release.
2. Sign the checksum file (minisign or GPG; minisign is one line and matches the age philosophy — small key, printable, no GPG swamp). Publish the public key in the repo AND on the site.
3. Reproducible-build doc: exact steps to rebuild a release from source and diff the bytes against the published artifact. Wire it to the existing self-host fixed-point machinery.
4. Download page copy (Track W/D): canonical URL, the checksums, the "verify it yourself" instructions, the public key. Make verification the default path, not a footnote.
5. Installer/bootstrap scripts fetch from the canonical GitHub Releases URL and verify the checksum before executing anything.

Acceptance

A published release carries SHA256SUMS + a valid signature; the documented rebuild procedure reproduces the artifact byte-for-byte on a clean machine; the download page shows the verify steps.

Log

• 2026-07-12 — opened, out of the website/impersonation discussion. The insight worth keeping: the anti-impersonation argument points toward the download pipeline being public and verifiable, not private.