Idira Signing Keys

Idira software releases are signed with GPG. Use this key to validate signed artifacts.

Download idira-public-keys.asc

Import the key

Import directly from the URL — no local download required: 

curl -s https://marketplace.idira.pan.dev/public-key/idira-public-keys.asc | gpg --import

Or, if you have downloaded the file locally: 

gpg --import idira-public-keys.asc

Verify a signed artifact

GPG detached signatures (.sig files) are distributed alongside releases. Run: 

gpg --verify <file>.sig <file>

A successful verification prints a Good signature line. A BAD signature warning means the file has been altered and must not be used.