Security

Release signing key

Every oncut release comes with a file named SHA256SUMS, which lists the SHA-256 checksum of each file in the release, and with SHA256SUMS.minisig, oncut's signature over that list. The key below is the one that signs it. With it you can check that a download came from oncut and arrived unmodified.

On Windows you do not need it: the installer is signed by oncut with an Authenticode certificate, which Windows checks for you. The Linux AppImage has no such check built into the system, so for Linux this key is the way to verify a download.

The current key

Key name
oncut Release Signing Key
Purpose
Signing official oncut software releases
Algorithm
Ed25519 (minisign)
Key id
3AA1B9E2CD1C2AE8
Valid from
2026-09-29
Status
Active
Public key
RWToKhzN4rmhOoC7T3/RBHpf8xrsnPwCU0ZsCVAXj3BUaXxysdHe15BF

The same key as a file, exactly as minisign wrote it: oncut-release.pub, and its SHA-256 in oncut-release.pub.sha256.

Check the key itself

A key is only worth trusting if it reaches you by a different route than the files it checks: someone who could replace a download on one server could replace a key next to it. So compare the key id above with the one printed in the README of oncut-apps/keylang on GitHub. They must be the same: 3AA1B9E2CD1C2AE8.

Verify a download

  1. Download SHA256SUMS and SHA256SUMS.minisig from the same release as your file, into the folder that holds it. Every release on apps.oncut.gr and on GitHub has both.
  2. Install minisign once. Ubuntu and Debian: sudo apt install minisign; other distributions package it too.
  3. In that folder, run these two commands, in this order: 
    minisign -Vm SHA256SUMS -P RWToKhzN4rmhOoC7T3/RBHpf8xrsnPwCU0ZsCVAXj3BUaXxysdHe15BF
sha256sum -c --ignore-missing SHA256SUMS

The first proves that SHA256SUMS came from oncut: minisign prints "Signature and comment signature verified" and the release it signs. The second proves that your file matches it, and prints OK beside the file name. Run both. The second alone only detects a broken download, because whoever can replace a file can replace a checksum beside it.

If you saved the key as a file, -p oncut-release.pub works in place of -P and the key.

If a check fails

Do not run the file. Download it again from apps.oncut.gr/keylang, and if the check still fails, write to support@oncut.gr with the file name and what the command printed.

Replaced and revoked keys

None. This key is replaced only if it is lost or exposed. A replaced key is never removed: it stays listed here with the date, the reason and what to do with files it signed, because older releases are still checked against it.