§NAME

verify - check a Nexus Market rotation announcement with PGP.

§SYNOPSIS

gpg --import nexus.asc
gpg --verify rotation.txt

§DESCRIPTION

Every time the operator publishes a new mirror address, the announcement is wrapped in a PGP-signed envelope. Verifying that signature against the operator public key proves the address really came from the operator. Any address published without a matching signature is untrusted.

The operator has not rotated the signing key on the current run of the market. Once you have the public key on your keyring, every future rotation verifies against the same fingerprint.

§PROCEDURE

1. Import the operator public key. Save the key block from the operator Dread profile to nexus.asc and import once.

gpg --import nexus.asc

2. Save the signed rotation. Copy the whole envelope from BEGIN PGP SIGNED MESSAGE to END PGP SIGNATURE. Do not strip the blank line after the hash header.

cat > rotation.txt <<'EOF'
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The current Nexus mirror is
<address>.onion
-----BEGIN PGP SIGNATURE-----
<signature bytes>
-----END PGP SIGNATURE-----
EOF

3. Verify. The command exits 0 on success.

gpg --verify rotation.txt

Success looks like Good signature from "Nexus <operator@...>". A trust-level warning is normal, it only means you have not personally signed the key. What matters is Good signature.

4. Match address. Compare the onion inside the message to the current entries on mirrors(5). Match wins.

§EXIT STATUS

0    Good signature. Trust the address inside.
1    Bad signature. Do not use.
2    Missing key. Import the operator key first.

§WARNINGS

Fetch the key from a source you already trust. If you get the key from the same page as the new address, and both live on a phishing site, both match and the check passes with a fake key. Import once, from a source you trust, then reuse forever.

§SEE ALSO

nexus(1), mirrors(5), history(7)