Five checks. One alarm.

Hash the bundle, check three signatures, compare to the device image. If anything misses, do not flash. Stop and ask.

Download the manifest and the bundle

Each release ships a signed JSON manifest alongside the binary bundle. Both come from the same public source. Mirror sites may host the bundle but never the private signing material.

shellcurl -L -O https://git.lydos.ailydian.com/lydos/releases/2026.06.r1/lydos_husky-target_files.zip
curl -L -O https://git.lydos.ailydian.com/lydos/releases/2026.06.r1/release.manifest.json
curl -L -O https://git.lydos.ailydian.com/lydos/releases/2026.06.r1/verify-bundle.sh
chmod +x verify-bundle.sh

Check the three signatures

shell./verify-bundle.sh --manifest release.manifest.json --signatures
# expected output:
#   release:    valid (key id 3571a6c8)
#   security:   valid (key id 9c4d77a1)
#   ops:        valid (key id 5f1e08b3)
#   quorum:     3 / 3 OK

If any signature fails

Do not proceed. A missing or invalid signature means the manifest cannot be trusted. Report the failure to security@lydos.ailydian.com with the manifest attached.

Hash the binary bundle

shell./verify-bundle.sh --bundle lydos_husky-target_files.zip --hash
# expected output:
#   build_sha256:           3571a6c85a15006d…
#   manifest_sha256:        3571a6c85a15006d…
#   match:                  yes

When it matches

The bundle was not modified between leaving the build pipeline and arriving on your machine. You can flash it confident that it is the same image we ship.

Compare to the device image (post-flash)

After flashing, open Sovereign Status on the device and tap Verify build hash. The phone computes the on-device image hash and displays it. Compare it side by side with the manifest hash.

shell# from your workstation:
adb shell 'sovereign-status --print-hash'
# expected output:
#   on_device_sha256:       3571a6c85a15006d…
#   match_with_manifest:    yes

What an attacker would need

For a malicious image to pass every check above, the attacker would need to compromise three independent signing roles, replace the public manifest, replace the device-side verifier, and reverse the on-device sovereign-status display. The point of this protocol is to make all four of those things infeasible at once.

Reproducible builds matter

If you want to verify the bundle itself — not just its signatures — follow Build the image and produce the bundle yourself. If your build hash matches ours, we are shipping the same source. If it does not, that is the alarm.