# MinIO AIStor release signing keys

MinIO AIStor downloads are signed with GPG and minisign, and its container images with cosign:

| Key | File | Check against |
|---|---|---|
| GPG | [`minio-gpg.asc`](minio-gpg.asc) | Fingerprint `4405 F3F0 DDBA 1B9E 68A3  1D25 12C7 4390 F9AA C728` (expires 2027-01-05) |
| minisign | [`minio-minisign.pub`](minio-minisign.pub) | `RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav` |
| cosign | [`minio-cosign.pub`](minio-cosign.pub) | SHA-256 `d875472f005c92492f4e46f1692080474d45f0d26076b9b485a5a75be61fcb60` |

Every binary has a GPG signature (`.asc`) and a minisign signature (`.minisig`) beside it. From `11.0.0-edge`,
every deb, rpm and apk package has them too, rpm packages are also signed inside, and `release.json` and
`channels.json` are signed with minisign. Packages of date-based releases (`RELEASE.*`, `EDGE.*`) are not signed.
Container images of `quay.io/minio/aistor/minio` built since mid-December 2025 (`EDGE.2025-12-13T08-46-12Z`,
`RELEASE.2025-12-20T04-58-37Z` and later) are signed with cosign, as are most other images under
`quay.io/minio/aistor/`.

## Import

```sh
curl -fsSLO https://dl.min.io/keys/minio-gpg.asc
gpg --show-keys minio-gpg.asc        # compare the full fingerprint above, not a short key ID
gpg --import minio-gpg.asc
sudo rpm --import minio-gpg.asc      # for rpm -Kv
curl -fsSLO https://dl.min.io/keys/minio-minisign.pub
curl -fsSLO https://dl.min.io/keys/minio-cosign.pub
sha256sum minio-cosign.pub           # compare with the SHA-256 above
```

The GPG key is also on `keyserver.ubuntu.com`.

## Verify

```sh
gpg --verify minio.asc minio                # "Good signature" and the fingerprint above
minisign -Vm minio -p minio-minisign.pub    # "Signature and comment signature verified"
rpm -Kv <package>.rpm                       # signature line ends "f9aac728: OK"
```

gpg's warning that the key "is not certified with a trusted signature" is expected; the fingerprint is what matters.

For a container image, cosign prints "The signatures were verified against the specified public key":

```sh
cosign verify --key minio-cosign.pub quay.io/minio/aistor/minio:11.0.0-edge
```

For a labelled release, verify its `release.json`, which lists the SHA-256 checksum of every binary and package in
the release:

```sh
minisign -Vm release.json -p minio-minisign.pub
```

## Key expiry

The GPG key's expiry will be extended before 2027-01-05; its fingerprint stays the same. Download and import the
key again then. For rpm, first remove the old copy: `sudo rpm -e --allmatches gpg-pubkey-f9aac728`.