Last updated: 3 August 2026

The AutomateNetOps on-premise agent is distributed as a signed release bundle. The installer (install.sh) verifies every bundle against a list of trusted minisign public keys baked into the script itself, and refuses to install anything it cannot verify.

This page exists so you can check that the keys baked into your copy of the installer are the real ones. It is served from automatenetops.ai — a different host, on different infrastructure, in a different account from app.automatenetops.ai, which is where the installer is downloaded from. That separation is the entire point: if the platform origin were compromised and served you a doctored installer with an attacker’s key baked in, this page would not change with it.

Verify at least one key ID here before your first install.

Current trusted keys

Production primary maintainer key

Key ID: A5172374DE5CECAE · in service since 3 August 2026

RWSu7FzedCMXpU/l4/zqYqhIaXXepqA0SE2N8FSPAVK+I7xa9CVxak3Y

Signs routine agent release bundles.

Production backup maintainer key

Key ID: D1837B1442C8E496 · in service since 3 August 2026

RWSW5MhCFHuD0Qn+bxi/d4wISItgTZzM5UcAyh4w5FVD+c3T9f+OXHw+

Held in separate custody from the primary. Used only when an urgent patch must ship and the primary key is unavailable — so an emergency release never has to be unsigned.

Chain-of-trust key

Key ID: E2970681C2D9AD6E · in service since 3 August 2026

RWRurdnCgQaX4mdTRGey48rBC5e7mRnUC5aYVRjrJLyifDqQHz5RKhNy

Signs only the key-allowlist response the installer fetches when checking whether the trusted key list has changed. It never signs a release bundle. Keeping the two roles on separate keys means a compromise of one cannot be used to forge the other.

How to check your installer

After downloading install.sh and before running it, compare the keys it carries against the list above:

grep -A 12 'TRUSTED_MINISIGN_PUBKEYS=(' install.sh
grep 'CHAIN_OF_TRUST_PUBKEY=' install.sh

Every key the script lists should appear on this page. If you want to confirm a bundle signature by hand:

minisign -V -m agent-<version>.tar.gz \
         -x agent-<version>.tar.gz.minisig \
         -P 'RWSu7FzedCMXpU/l4/zqYqhIaXXepqA0SE2N8FSPAVK+I7xa9CVxak3Y'

A successful check prints Signature and comment signature verified.

If the keys do not match, stop. Do not run the installer, and do not work around a failed signature check. Contact security@automatenetops.ai and include the key IDs you saw. A mismatch is worth a false alarm.

Notes on rotation

Keys are rotated on a schedule and immediately on any suspected compromise. During a planned rotation both the outgoing and incoming keys are listed here for an overlap period, so an installer downloaded before the change keeps working while it is still current.

The installer also expires: a copy more than 365 days old refuses to run, rather than going on trusting a key list that may since have changed. If you hit that, download a fresh copy — do not override the check.

Fingerprints are also provided through operator onboarding correspondence when your account is created. Two independent channels is the intended minimum; if the two ever disagree, treat it as an incident and contact us.