Trust & Supply Chain

Don't trust the download.
Verify it.

Every WAFio release is signed with Ed25519, checksummed, and ships with a full SPDX bill of materials. No agent installs an artefact it cannot verify — and neither should you.

      
Artefacts

Current release, byte for byte

What the install script fetches today. Hashes below are served from the release manifest, not this page.

Verify

Three commands, zero trust required

Run these on any machine after downloading. They use the same public key and payload format as the agents themselves.

01

Checksum the artefact

Compare against the manifest hash above.

curl -fsSL -o wafio.tar.gz \
  https://wafio.cloud/api/download/waf-agent
shasum -a 256 wafio.tar.gz
02

Check the Ed25519 signature

Fetch the signature JSON, rebuild the payload, verify against the published key. OpenSSL 1.1.1+ required.

curl -fsSL https://wafio.cloud/api/download/waf-agent/sig \
  | python3 -c 'import sys,json; d=json.load(sys.stdin); \
print(d["signature"], file=open("sig.b64","w")); print(d["sha256"])'
printf 'wafio-release-v1\nvVERSION\nSHA256' > payload
base64 -d sig.b64 > sig.bin
openssl pkeyutl -verify -pubin -inkey pub.pem \
  -rawin -in payload -sigfile sig.bin
03

Scan the SBOM

Every dependency in the bundle, checked against known CVEs.

curl -fsSL -o bundle.sbom.json \
  https://wafio.cloud/api/download/waf-agent/sbom
grype sbom:bundle.sbom.json
Key

The signing key

Ed25519. Generated offline, never stored on any server, and rotated on any suspicion of exposure. Agents embed it at compile time and refuse unsigned updates.

No signing key published yet

Release signing is fail-closed by design: agents refuse self-updates until a key is compiled in, and the first signed release publishes the key here. Until then, releases are distributed with SHA-256 checksums only — verify hashes against this page before installing on anything you care about.

Found something?

Report security issues to security@wafio.cloud. We answer within 48 hours and credit responsible disclosure. A /.well-known/security.txt with full policy is published on this domain.

Response target 48 hours
Scope Portal, control plane, agents, eBPF