Package signing (GPG)

Official Linux packages from astrastudio (Fedora .rpm and Debian / Raspberry Pi OS .deb) are signed with this OpenPGP key. Use it to check that a file came from us and was not altered.

Download: https://www.astrastudio.de/GPG-KEY-astrastudio

The file must start with —–BEGIN PGP PUBLIC KEY BLOCK—–. It is a plain key file, not an HTML page, and it does not require a login.

Compare the fingerprint on this page with the downloaded file before you import the key.

Verify the file:

curl -fsSL https://www.astrastudio.de/GPG-KEY-astrastudio | gpg --show-keys --with-fingerprint --with-subkey-fingerprint

Import the key once, then install the shop RPM:

sudo rpm --import https://www.astrastudio.de/GPG-KEY-astrastudio
sudo dnf install ./OnAirScreen_*_Fedora_x64.rpm

Check the package after importing the key:

rpm -K OnAirScreen_*_Fedora_x64.rpm

Expected: digests signatures OK. Without the imported key the signature shows as NOT OK / NOKEY even if the file is intact.

Shop download: customer.astrastudio.de

The same public key file signs the .deb packages. apt does not check the package signature on a local file — verify it with debsigs, import the key, then install as usual:

sudo apt install debsigs
curl -fsSL https://www.astrastudio.de/GPG-KEY-astrastudio | gpg --import
debsigs --verify OnAirScreen_*.deb
sudo apt install ./OnAirScreen_*.deb

Install guide: Install OnAirScreen from a .deb.

• The public key at the download link above is all you need. Private key files are not required.
• When the signing subkey expires, we replace it here and in the key file. The primary fingerprint usually stays the same.
• Questions: Contact