Verifying a Release — Rapid Lens Knowledge Base

Every Rapid BI Catalog install and update verifies the release before it touches your system. This page describes those checks, publishes the signing key's fingerprint so you can confirm it independently, and gives the commands to verify a download by hand.

What is checked

The installers and update scripts run three checks. Any one of them failing aborts the run.

Check	What it tells you
SHA-256 checksum	The download is complete and intact
GPG signature	It was signed with the Rapid BI Catalog release key
Signing-key fingerprint	It was signed with our key — not merely by whoever served the file

The third check is the one that makes the other two meaningful. Each install and update script carries the expected fingerprint and refuses a release signed by any other key, even if that key's signature is internally valid.

The signing key

Releases are signed with this key:

Field	Value
Key	RapidLens Releases <releases@rapidlens.com>
Fingerprint	`1437 D891 A440 1E8B CDEB EFBA AF2D 79D3 516B FC54`
Type	RSA 4096
Valid	18 June 2026 to 17 June 2029

Tools usually print the fingerprint without spaces, as 1437D891A4401E8BCDEBEFBAAF2D79D3516BFC54. That is the form to compare.

Check the installer before you run it

The install and uninstall commands in this documentation pipe a script straight into a shell. If you would rather inspect it first, download it, confirm it carries the fingerprint published above, then run it:

Terminal

$ curl -fsSL https://app.rapidlens.com/releases-bicatalog/v8.0.0/online/scripts/ubuntu/install.sh -o install.sh
grep EXPECTED_FINGERPRINT install.sh
sh install.sh

The grep prints the fingerprint that script will accept:

Expected output

$ EXPECTED_FINGERPRINT="1437D891A4401E8BCDEBEFBAAF2D79D3516BFC54"

Substitute your distribution for ubuntu. If that value does not match the fingerprint published above, do not run the script.

Verify a download by hand

If your policy requires verifying the release itself rather than trusting the installer to do it, download the archive and its two sidecar files together with the public key, then check both.

Terminal

$ base=https://app.rapidlens.com/releases-bicatalog/v8.0.0
curl -fsSLO $base/online/bicatalog-linux-x64.tar.gz
curl -fsSLO $base/online/bicatalog-linux-x64.tar.gz.sha256
curl -fsSLO $base/online/bicatalog-linux-x64.tar.gz.asc
curl -fsSLO $base/signing.pub

Confirm the key is ours before you trust anything it signed:

Terminal

$ export GNUPGHOME=$(mktemp -d)
gpg --batch --with-colons --import-options show-only --import signing.pub | awk -F: '/^fpr:/{print $10; exit}'

That prints the key's fingerprint. Compare it with the one published above, then import the key and run the two checks:

Terminal

$ gpg --batch --import signing.pub
gpg --batch --verify bicatalog-linux-x64.tar.gz.asc bicatalog-linux-x64.tar.gz
sha256sum -c bicatalog-linux-x64.tar.gz.sha256

Use a temporary keyring

Setting GNUPGHOME to a temporary directory keeps the imported key out of your own keyring. Recent GnuPG versions ignore the older --keyring option, so this is the reliable way to keep the check self-contained.

Offline installs

The offline bundle carries the public key inside it as SIGNING.pub, so an offline install downloads nothing and the same three checks run against files that travelled together. The fingerprint comparison is unchanged — check SIGNING.pub from the extracted bundle with the same command as above.

What a failure looks like

Each check aborts with its own message, and nothing is installed:

Message	What happened	What to do
SHA256 verification failed. The archive may be corrupted or tampered with. Aborting.	The download does not match its checksum	Usually an interrupted or proxied download. Retry; if it recurs, contact support before installing.
Signing key fingerprint mismatch (got …, expected …). The release is signed by a key this installer does not trust. Aborting.	The release was signed by a key the installer does not accept	Compare both values with the fingerprint on this page and contact support.
Could not read the signing key fingerprint. Aborting.	The public key could not be read	Usually a truncated or corrupted `signing.pub` download. Retry.
GPG signature verification failed. The archive may have been tampered with. Aborting.	The signature does not match the archive	Contact support before installing.
gpg is required for signature verification but not found. Install gnupg and re-run.	GPG is not installed on the machine	Install `gnupg` and run the installer again.

Next Steps

Install Rapid BI Catalog: Installation
Hosts the installer needs to reach: Egress Allowlist
Remove an installation: Uninstall & Deactivation