Skip to main content
Regulaxy
עברית

Product security

Our signing key

This is where we publish the public keys our installers and licence files are signed with, together with their fingerprints.

Signing release artefacts

OpenPGP, because your security team already has the tooling and the procedure for gpg --verify against a checksums file.

Key id

demo-artifact-2026a

Currentopenpgp

The value shown here is not a real key

This deployment is loaded with demonstration data. The value below exists so that the shape of the page can be seen, and is not derived from any private key that exists anywhere. Do not compare anything against it.

FingerprintDEMO 0000 0000 0000 0000 0000 0000 0000 0000 0000
Valid from
Valid until
Not yet announced
The public key
-----BEGIN PGP PUBLIC KEY BLOCK-----
DEMO NOT A REAL KEY
-----END PGP PUBLIC KEY BLOCK-----

Signing licence files

Ed25519, verified offline inside the product against a key compiled into it. An isolated server cannot fetch a key at runtime.

Key id

demo-sign-2026a

Currented25519

The value shown here is not a real key

This deployment is loaded with demonstration data. The value below exists so that the shape of the page can be seen, and is not derived from any private key that exists anywhere. Do not compare anything against it.

FingerprintDEMO:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
Valid from
Valid until
Not yet announced
The public key
DEMO-NOT-A-REAL-PUBLIC-KEY-DEMO-NOT-A-REAL-PUBLIC-KEY=

Why this is public

Verification happens on the machine that carries the media inside, usually in the hands of someone with no portal account — a technician, a contractor, a security engineer. A signing key published only behind a login breaks the chain of custody at the exact step it exists for.

What is not here

The private half of the key is not in this website's database, not in its runtime environment, and not reachable from any of these screens. Signing happens in a separate service that holds the key in a KMS/HSM.

Do not rely on this page alone

Anyone who can substitute your installer can also serve you a site that looks like ours. The fingerprint is published in four places that do not depend on each other, and comparing two of them is the real check:

  1. This page.
  2. Your signed agreement.
  3. The previous release's offline bundle, which you already hold.
  4. The README inside the installation bundle itself.

How to verify

# Import the key
gpg --import regulaxy-signing-key.asc

# Check the fingerprint
gpg --fingerprint <key-id>

# Verify a file
gpg --verify regulaxy-<version>.iso.sig regulaxy-<version>.iso

Security advisories · Release lifecycle