Security

Checking your download

Every vrOS release is signed twice. This page is the reference you compare a signature against — on its own, a signature proves nothing.

What the signature does and does not prove

vrOS is signed with a self-signed certificate. That is a deliberate choice: the point is to show a build came from us, not to make Windows stop warning about it. Windows will still say the publisher is unverified, and that is expected.

What it gives you is a fingerprint. If the one on your copy matches the one below, the file came from us and has not been altered since. If it does not match, something is wrong — see the bottom of this page.

This is protection against a corrupted download or a modified file, not against someone who has already taken over your machine. Anyone who can patch the binary can also patch the part that checks it.

Windows

Right-click vros.exe, choose Properties, and open the Digital Signatures tab. Or, in PowerShell:

Subject: CN=catnet systems
SHA-256 thumbprint: 003F 4DCF 8160 8871 CB68 85F6 1071 C42A DCE6 7DC4 BF7C 2E83 6326 7B50 1F28 68F9

Get-AuthenticodeSignature vros.exe | Format-List

Expect Status to read NotTrusted or UnknownError. That is what a self-signed certificate looks like and it is correct. What matters is the certificate: its subject and thumbprint must match the values above. Status "HashMismatch" is the one that means trouble.

Every platform

Each release ships a SHA256SUMS file listing the hash of the binary, signed with the same SSH key that signs every commit in the project. This is the check that works on Linux, where nothing verifies a binary for you.

Save the public key below as vros-release.pub, then build an allowed-signers line from it.
Check the hash matches the binary.
Check the signature on the hash file.

Public key

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICo4wouetRRRvTvo/skt/npKjIwb9bjRLrj35wyWK3Vv

allowed_signers

releases@vros.cat namespaces="vros-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICo4wouetRRRvTvo/skt/npKjIwb9bjRLrj35wyWK3Vv

The namespace matters. Release signatures use their own, so a key trusted for releases is not silently trusted for anything else.

Check the hash

sha256sum -c SHA256SUMS

Check the signature

ssh-keygen -Y verify -f allowed_signers -I releases@vros.cat \
  -n vros-release -s SHA256SUMS.sig < SHA256SUMS

Inside the app

vrOS shows the same fingerprint itself. Open the tray icon and choose About: the SIGNATURE section names the certificate that signed the copy you are running. Compare it with this page.

If it does not match

Do not run the file.

Delete it and reinstall through Steam, which verifies its own downloads. If a fresh install still does not match, that is worth telling us about.

Tell us on Discord