Don't trust the download.
Verify it.
Every WAFio release is signed with Ed25519, checksummed, and ships with a full SPDX bill of materials. No agent installs an artefact it cannot verify — and neither should you.
Current release, byte for byte
What the install script fetches today. Hashes below are served from the release manifest, not this page.
Three commands, zero trust required
Run these on any machine after downloading. They use the same public key and payload format as the agents themselves.
Checksum the artefact
Compare against the manifest hash above.
curl -fsSL -o wafio.tar.gz \
https://wafio.cloud/api/download/waf-agent
shasum -a 256 wafio.tar.gzCheck the Ed25519 signature
Fetch the signature JSON, rebuild the payload, verify against the published key. OpenSSL 1.1.1+ required.
curl -fsSL https://wafio.cloud/api/download/waf-agent/sig \
| python3 -c 'import sys,json; d=json.load(sys.stdin); \
print(d["signature"], file=open("sig.b64","w")); print(d["sha256"])'
printf 'wafio-release-v1\nvVERSION\nSHA256' > payload
base64 -d sig.b64 > sig.bin
openssl pkeyutl -verify -pubin -inkey pub.pem \
-rawin -in payload -sigfile sig.binScan the SBOM
Every dependency in the bundle, checked against known CVEs.
curl -fsSL -o bundle.sbom.json \
https://wafio.cloud/api/download/waf-agent/sbom
grype sbom:bundle.sbom.jsonThe signing key
Ed25519. Generated offline, never stored on any server, and rotated on any suspicion of exposure. Agents embed it at compile time and refuse unsigned updates.
No signing key published yet
Release signing is fail-closed by design: agents refuse self-updates until a key is compiled in, and the first signed release publishes the key here. Until then, releases are distributed with SHA-256 checksums only — verify hashes against this page before installing on anything you care about.
Found something?
Report security issues to security@wafio.cloud.
We answer within 48 hours and credit responsible disclosure. A /.well-known/security.txt with full policy is published on this domain.