Where this key is used
A-Packets is a self-hosted PCAP analysis platform delivered as a signed package. Every release artifact and container image - the Docker Compose archive, the Helm chart and the air-gapped bundle - is signed with the ECDSA P-256 key below.
Every container image also has an SBOM, stored next to it in the registry and available with the same credentials you use to pull images.
This page is the independent reference for that key. Delivery emails, download links and the package itself can all be tampered with together; the fingerprint published here is the value your verification must match. Open this page directly rather than through a link in the delivery message, then return to your installation guide:
- Docker Compose installation - single Linux host, Starter package.
- Kubernetes installation with Helm - Pro and Enterprise clusters.
- Air-gapped installation - offline Kubernetes environments.
| Property | Value |
|---|---|
| Algorithm | ECDSA P-256 |
| Key file | apackets-cosign.pub |
| Format | PEM (SPKI) |
| Used by | Cosign, to verify release checksums and container images. |
Public key
The same key signs every self-hosted package. It does not change between releases.
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJ5x234EJhQ37m/oJGWlSRLdPf3Mu
mshp2WAZtOBSakYBSK29hMZPPtC63RbBHlzc4qBn8qyRnDVzaFKYSZWz8A==
-----END PUBLIC KEY-----Fingerprint
SHA-256 of the DER-encoded public key:
7e444fc350be1d28f2121a517849c530f1c32c7a807f19e798b90708b7223eafReproduce the fingerprint
Run this against the key file you received and compare the output with the value above:
openssl pkey -pubin -in apackets-cosign.pub -outform DER | openssl dgst -sha256If the fingerprint you compute does not match the value on this page, stop. Do not extract or install the package, keep the files you received together with the verification output, and contact A-Packets support before going further.
Continue with your installation
Once the key matches, the next step is to verify the signature on the checksum file and the checksum of the archive itself. Each deployment guide covers that verification in full, with the commands for its package:
For deployment options, licensing and system requirements for the self-hosted product, see A-Packets On-Premise.