veil

Install the command line tool

Install veil from the signed apt repository, winget or Homebrew, and check the repository key against the Veil organisation’s card.

veil does from a terminal what a card does in the browser. Look someone up by an account you already know and get the keys on their card, or start from a key or a signature and find the card that holds it. veil checks each card on your computer against the public log and its witnesses, verifies signed messages, files and releases, and writes keys in the formats ssh, git and gpg read. It is a single program with no dependencies, for Linux, Windows and macOS on x86-64 and ARM64.

Debian and Ubuntu#

cURL
curl -fsS https://apt.veil.rip/veil.gpg | sudo tee /usr/share/keyrings/veil.gpg > /dev/null
echo 'deb [signed-by=/usr/share/keyrings/veil.gpg] https://apt.veil.rip stable main' \
  | sudo tee /etc/apt/sources.list.d/veil.list
sudo apt update && sudo apt install veil

The repository signs its indexes with its own OpenPGP key, and that key is on the Veil organisation’s card at veil.rip/o/veil, under Public keys from elsewhere. Before the first apt update, print the fingerprint of the key you downloaded and compare it with the card. The card page checks the card in your browser, so a key swapped on apt.veil.rip would not match. apt checks every later update against this key, so you compare it once.

cURL
gpg --show-keys /usr/share/keyrings/veil.gpg

The fingerprint is 7B08106A065E8920A562C80BDF581F51AE6EE7E1. The package installs the man pages and the bash, zsh and fish completions. Check it with veil --version.

Windows#

cURL
winget install Veil.Veil

scoop bucket add veil https://github.com/Veil-OSS/scoop-veil
scoop install veil

Either command is enough. winget and Scoop download the release zip, compare its SHA-256 with the one in their manifest and put veil.exe on your PATH. veil isn’t signed with a code signing certificate yet, so if you download the zip by hand and open veil.exe from Explorer, Microsoft Defender SmartScreen shows “Windows protected your PC” with an unknown publisher. Check the zip against SHA256SUMS first, as below. Then choose More info and Run anyway, or run Unblock-File veil.exe in PowerShell. winget and Scoop don’t trigger that warning.

macOS#

cURL
brew install veil-oss/veil/veil

The formula comes from the Veil tap, Veil-OSS/homebrew-veil. It downloads the release zip for your Mac, checks its SHA-256, and installs the man pages and the completions.

Check a download by hand#

Each release has one SHA256SUMS file for every package and zip, and SHA256SUMS.veil, a Veil block signed by a device key of the Veil organisation’s card. Drop the list, its signature and your file on veil.rip/verify under File or release, or check them with the tool you already have.

cURL
sha256sum --check --ignore-missing SHA256SUMS
veil verify --release SHA256SUMS --sig SHA256SUMS.veil

Read this entry as JSON