https://rmqa.com/tags/signatures/ Recent content in Signatures on rmqa.com Hugo en-us Wed, 04 Nov 2026 00:00:00 +0000 https://rmqa.com/rmqa-0.2-opens-tar.xz-and-zstd-releases-and-verifies-their-signatures/ Wed, 04 Nov 2026 00:00:00 +0000 https://rmqa.com/rmqa-0.2-opens-tar.xz-and-zstd-releases-and-verifies-their-signatures/ <p>rmqa 0.1 couldn&rsquo;t open a large share of the releases people actually publish. cargo-dist, the release tool most Rust projects use, packs every build as <code>.tar.xz</code>. More C and Rust projects ship <code>.tar.zst</code> each year. rmqa saw those files, counted their bytes and moved on, so a wrong build inside one went through.</p> <p>0.2 reads both. The xz and zstd readers are rmqa&rsquo;s own, written in Go from the format specifications, so rmqa is still one file with nothing to install beside it. Before trusting them, they were checked against files made by the real tools: xz and zstd at many levels and window sizes, with every kind of built-in check, and damaged copies that must fail. They agreed byte for byte. Each format&rsquo;s own check (CRC32, CRC64 or SHA-256 for xz, the content checksum for zstd) is verified on the way.</p>