1e019bad0e
rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all: the import fails and package verification reports SIGNATURES NOT OK. RHEL 8 is supported until 2029 and is a realistic target for a signed package repo, so the Ed25519 key excludes a large part of the rpm audience. Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay verifiable. Workflows derive the key id from the imported secret key, so no workflow change is needed.
1.8 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 0.9.8 | ✅ |
| < 0.9.8 | ❌ |
Reporting a Vulnerability
Report to 3proxy@3proxy.org or via GitHub security reporting
For High/Critical patched version is released within 2 weeks
Verifying downloads
Release binaries are published with SHA256 checksums, an OpenPGP signature and a GitHub build provenance attestation.
The release signing key is 3proxy-release-key.asc in the root of this
repository, an RSA-4096 key:
pub rsa4096 2026-08-21 [SC]
FC12 2144 99FC C7BA 1CFF 6CDC 0312 384E 3A73 940B
uid 3proxy release signing <3proxy@3proxy.org>
Import it once:
gpg --import 3proxy-release-key.asc
Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
3proxy-release-key-ed25519.asc for verifying those older files. Note that
rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
and will report SIGNATURES NOT OK; use the RSA key and 0.9.9.1 or later on
those systems.
Checksums and the checksum file signature:
gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
sha256sum -c SHA256SUMS-x86_64
RPM packages are signed, the signature is checked by rpm itself:
sudo rpm --import 3proxy-release-key.asc
rpm -K 3proxy-0.9.9.x86_64.rpm
DEB packages are published with a detached signature:
gpg --verify 3proxy-0.9.9.x86_64.deb.asc 3proxy-0.9.9.x86_64.deb
Build provenance (which workflow, commit and runner produced the file) is verified with the GitHub CLI:
gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy
gh attestation verify oci://docker.io/3proxy/3proxy:latest --owner 3proxy
Windows binaries are Authenticode signed in addition to the above.