v0.1.2

VeilVoice v0.1.2

Irreversible voice de-identification, fully offline.

Verify what you downloaded

sha256sum -c SHA256SUMS --ignore-missing

Verify the signature

SHA256SUMS.asc is a detached OpenPGP signature over the hash list.
No binary is signed in place, so signing cannot disturb the bit-for-bit
reproducibility above.

1. Import the key (also on the website):

gpg --import veilvoice-signing-key.asc

2. Check the fingerprint is exactly this. A "Good signature" from
some other key proves nothing — the fingerprint is the part that matters:

8101FB3BB28D02FB239E0CDF9CC1C7E7A9B5833A

3. Verify the hash list, then the files against it:

gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

Expect Good signature from "tilas01". The key carries no e-mail
address by design. GnuPG will also warn that the key is not certified
with a trusted signature — that is normal and simply means you have not
personally signed it; the fingerprint check above is what establishes
that it is the right key.

On macOS use shasum -a 256 -c SHA256SUMS --ignore-missing.

Reproducibility

Every binary was built twice, in different directories, and compared:

• linux-x86_64: reproducible
• macos-arm64: reproducible
• macos-x86_64: reproducible
• windows-x86_64: reproducible

See docs/REPRODUCIBLE_BUILDS.md to reproduce a build yourself.

Built on: Linux runners, toolchain pinned by rust-toolchain.toml.