Verifying the cs-coverage CLI Download with GPG

The cs-coverage CLI is distributed as a zip archive alongside a checksum file (cs-coverage.sha256) and a detached GPG signature (cs-coverage.sha256.asc). The signature lets you confirm that the checksum and therefore the binary genuinely came from CodeScene, independent of how you pin or cache the download in CI.

Where to get the public key

CodeScene's signing key is published at a stable URL:

https://downloads.codescene.io/enterprise/keys/codescene-cli-gpg-public.asc

Fingerprint: 2E8D D144 459E DC18 5E25 9118 3C04 140B D929 767D

Confirm this fingerprint matches what's shown after import (Step 2 below) before trusting any signature verified with it.

Verifying a download

1. Import the public key.

curl -O https://downloads.codescene.io/enterprise/keys/codescene-cli-gpg-public.asc gpg --import codescene-cli-gpg-public.asc

2. Confirm the fingerprint.

gpg --fingerprint operations@codescene.com

The output should show 2E8D D144 459E DC18 5E25 9118 3C04 140B D929 767D. Don't proceed if it doesn't match.

3. Verify the signature against the checksum file.

Download cs-coverage.sha256 and cs-coverage.sha256.asc alongside the CLI zip, then run:

gpg --verify cs-coverage.sha256.asc cs-coverage.sha256

A Good signature from "... <operations@codescene.com>" confirms the checksum file is authentic and untampered.

4. Verify the downloaded zip against the checksum.

sha256sum -c cs-coverage.sha256

Only after both checks pass should the zip be trusted and unpacked.

Key validity and rotation

  • There is no active automated rotation policy, the key remains in use until it expires.

  • When a new key is issued, it will be published at the same URL above, replacing the current key.

Frequently Asked Questions

Q: Why isn't there a versioned download URL for cs-coverage? A: The CLI is currently published as a single rolling artifact (cs-coverage-linux-amd64-latest.zip). If you need to pin a specific build in CI, verify against the signed checksum rather than the zip's own hash, since the zip is republished over time.

Q: Will I be notified before the key expires or rotates? A: A new key will be published at the same stable URL when rotation happens. There's no separate notification channel today, check this article if your verification starts failing.

Q: Does install-cs-coverage-tool.sh verify the signature automatically? A: No. The install script does not currently check .sha256 or .asc files. If your CI requires verified provenance, run the steps above as a separate step before invoking the install script.

Key points to remember

  • Public key: https://downloads.codescene.io/enterprise/keys/codescene-cli-gpg-public.asc

  • Fingerprint: 2E8D D144 459E DC18 5E25 9118 3C04 140B D929 767D

  • Always verify the fingerprint after import, before trusting any signature.

  • Verify cs-coverage.sha256.asc against cs-coverage.sha256 with GPG, then verify the zip against cs-coverage.sha256 with sha256sum -c.

  • A replacement will be published at the same URL if rotated.