Linux applications for local hardware development.

Check that the package is the one we built.

Each product has its own release key and immutable trust files. Use only the key and links listed for the product you downloaded.

ISA Design Studio · Checksum signing key

Ed25519. The key identity and bytes are pinned independently from the authenticated package download.

isa-download-ed25519-2026-01
qqPYrXLxnAe3qE/rVcmf7wNUj3ZQR38VaEYOF+3QzV8=

• SHA256SUMS
• SHA256SUMS.sig

Checksum and detached signature

curl -fLO https://www.altifigence.com/downloads/isa-design-studio/trust/SHA256SUMS
curl -fLO https://www.altifigence.com/downloads/isa-design-studio/trust/SHA256SUMS.sig

{ printf '302a300506032b6570032100' | xxd -r -p
  printf 'qqPYrXLxnAe3qE/rVcmf7wNUj3ZQR38VaEYOF+3QzV8=' | base64 -d
} | { echo "-----BEGIN PUBLIC KEY-----"; base64 -w64; echo "-----END PUBLIC KEY-----"; } > isa-download.pem

openssl pkeyutl -verify -pubin -inkey isa-download.pem \
  -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig

grep -E '^[0-9a-f]{64}  altifigence-isa-design-studio_0\.1\.1_amd64\.deb$' \
  SHA256SUMS > PACKAGE.SHA256
test "$(wc -l < PACKAGE.SHA256)" -eq 1
sha256sum -c PACKAGE.SHA256

First verify the signature over the complete manifest. Then the final three commands select exactly one package entry and check only the package you downloaded. Any failure means stop.

SystemVerilog IDE · Checksum signing key

Ed25519. The key identity and bytes are pinned independently from the authenticated package download.

ide-download-2026-08-v1
0Km02/+3ttNrM7J6RZ7dTFIPa4TLTMrbrJ0OUOvgjsE=

• SHA256SUMS
• SHA256SUMS.sig

curl -fLO https://www.altifigence.com/downloads/systemverilog-ide/trust/SHA256SUMS
curl -fLO https://www.altifigence.com/downloads/systemverilog-ide/trust/SHA256SUMS.sig

{ printf '302a300506032b6570032100' | xxd -r -p
  printf '0Km02/+3ttNrM7J6RZ7dTFIPa4TLTMrbrJ0OUOvgjsE=' | base64 -d
} | { echo "-----BEGIN PUBLIC KEY-----"; base64 -w64; echo "-----END PUBLIC KEY-----"; } > ide-download.pem

openssl pkeyutl -verify -pubin -inkey ide-download.pem \
  -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig

grep -E '^[0-9a-f]{64}  altifigence-systemverilog-ide_0\.1\.6_amd64\.deb$' \
  SHA256SUMS > PACKAGE.SHA256
test "$(wc -l < PACKAGE.SHA256)" -eq 1
sha256sum -c PACKAGE.SHA256

ISA Design Studio · Package signature

Verification has two layers. If you received the whole asset bundle, check SHA256SUMS as above; if all you hold is the package file, check the signature carried inside it. The second layer is the one that matters, because an internal mirror or a USB stick leaves nothing behind but the .deb. Take the fingerprint below from this page — a value that travelled with the download cannot vouch for that download.

Installing debsig-verify changes every installation on that machine. dpkg calls it on each unpack once it is on PATH, and refuses any package it holds no policy for, which means the rest of your distribution stops installing. So run the check per package, the way it is written below. Leaving it enforcing is for people who hold a policy for every package they use. To undo it: sudo apt-get remove debsig-verify, or dpkg --no-debsig in a hurry.

• altifigence-desktop.pol — the policy that tells dpkg which key may sign our packages.
• altifigence-desktop.gpg — that key itself, in the OpenPGP keyring form debsig-verify reads.
• altifigence-desktop-packages.asc — the same public key in inspectable armored form.

Both go under a directory named after the fingerprint. That directory name is the key you are choosing to trust, so compare it against the value above before you create it.

sudo apt-get install debsig-verify

FPR=424A21FF75925085003DBD46C0DA0C25F6B82E42
curl -fLO https://www.altifigence.com/downloads/isa-design-studio/trust/altifigence-desktop.pol
curl -fLO https://www.altifigence.com/downloads/isa-design-studio/trust/altifigence-desktop.gpg

sudo mkdir -p "/usr/share/debsig/keyrings/$FPR" "/etc/debsig/policies/$FPR"
sudo cp altifigence-desktop.gpg "/usr/share/debsig/keyrings/$FPR/"
sudo cp altifigence-desktop.pol "/etc/debsig/policies/$FPR/"

debsig-verify altifigence-isa-design-studio_0.1.1_amd64.deb

SystemVerilog IDE · Package signature

• altifigence-desktop.pol — the policy that tells dpkg which key may sign our packages.
• altifigence-desktop.gpg — that key itself, in the OpenPGP keyring form debsig-verify reads.
• altifigence-desktop-packages.asc — the same public key in inspectable armored form.

FPR=1AD14D70B6EB0DDE1119E705F44BC2496665A843
curl -fLO https://www.altifigence.com/downloads/systemverilog-ide/trust/altifigence-desktop.pol
curl -fLO https://www.altifigence.com/downloads/systemverilog-ide/trust/altifigence-desktop.gpg

sudo mkdir -p "/usr/share/debsig/keyrings/$FPR" "/etc/debsig/policies/$FPR"
sudo cp altifigence-desktop.gpg "/usr/share/debsig/keyrings/$FPR/"
sudo cp altifigence-desktop.pol "/etc/debsig/policies/$FPR/"

debsig-verify altifigence-systemverilog-ide_0.1.6_amd64.deb

The exit code is the answer.

• 0 — we signed it, and the contents are unchanged.
• 10 — there is no signature at all.
• 11 — there is a signature, but no policy for its key. This is the correct result before you install the two files above.
• 13 — the signature does not match the contents. The file changed.

Altifigence CLI · Signed archive

The CLI is not a Debian package. Verify its detached archive signature with the pinned release public-key digest before extracting it.

rsa4096:d4b5b6c2d55fa8fe46a2f8e2fd80ac3b4cb06082fa537bb9ac57df0bd58e0564
public-key DER SHA-256: d4b5b6c2d55fa8fe46a2f8e2fd80ac3b4cb06082fa537bb9ac57df0bd58e0564

• SHA256SUMS
• SHA256SUMS.sig
• altifigence-cli-v0.1.0-x86_64-unknown-linux-gnu.tar.gz.sig
• CLI-RELEASE-PUBLIC-KEY.pem

EXPECTED_CLI_PUBLIC_KEY_SHA256=d4b5b6c2d55fa8fe46a2f8e2fd80ac3b4cb06082fa537bb9ac57df0bd58e0564
ACTUAL_CLI_PUBLIC_KEY_SHA256="$(openssl pkey -pubin \
  -in CLI-RELEASE-PUBLIC-KEY.pem -outform DER \
  | sha256sum | cut -d' ' -f1)"
test "$ACTUAL_CLI_PUBLIC_KEY_SHA256" = "$EXPECTED_CLI_PUBLIC_KEY_SHA256"

openssl dgst -sha256 -verify CLI-RELEASE-PUBLIC-KEY.pem \
  -signature altifigence-cli-v0.1.0-x86_64-unknown-linux-gnu.tar.gz.sig \
  altifigence-cli-v0.1.0-x86_64-unknown-linux-gnu.tar.gz

Build provenance

Each package carries a signed statement of which workflow, at which commit, produced those exact bytes. The GitHub CLI checks it against the public transparency log.

gh attestation verify altifigence-systemverilog-ide_0.1.6_amd64.deb \
  --repo altifigence-internal/ide

The verification files are public so a file received elsewhere can be checked independently. The package download itself still requires an authenticated Altifigence session.