Starlink Video Link
for UAVs

Authenticate the checksum with the independently pinned AirOS release key before trusting the image. Set air_image to the Strike filename when downloading Strike. The AIR_OS_INSTALLER_SIGNATURE_V2 statement also binds the provenance and adjacent verifier bytes. The fail-closed inline bootstrap authenticates them without executing code from the download mirror.

(
set -euo pipefail
umask 077
AIR_INSTALLER_PUBKEY=f79ecbda6904e34556616c7a537dea8740609b19f07a556b9eb783d7751838fb
air_image=air-os-latest.img.xz # air-os-latest-strike.img.xz for Strike
air_download_dir="$(pwd)/air-os-verified"; mkdir -- "$air_download_dir"; cd -- "$air_download_dir"
air_verify_tmp="$(mktemp -d ./verify.XXXXXX)"; trap 'rm -rf -- "$air_verify_tmp"' EXIT
air_fetch() {
  local f="$1" max="$2" size partial="$air_verify_tmp/download.part"
  rm -f -- "$partial"
  if ! curl --proto '=https' --tlsv1.2 --fail --location --show-error --max-filesize "$max" "https://air.airdroper.org/downloads/$f" | head -c "$((max + 1))" >"$partial"; then rm -f -- "$partial"; return 1; fi
  size="$(stat -c '%s' "$partial")"
  if ! [[ "$size" =~ ^[0-9]+$ ]] || test "$size" -le 0 || test "$size" -gt "$max"; then rm -f -- "$partial"; return 1; fi
  mv -f -- "$partial" "$f"
}
air_fetch "$air_image.sha256" 65536
air_fetch "$air_image.sha256.sig" 256
air_fetch "$air_image.provenance" 1048576
air_fetch "$air_image.verify.sh" 1048576
air_fetch air-os-installer-ed25519.pub 128
key="${AIR_INSTALLER_PUBKEY,,}"; test "$(tr -d '\r\n' < air-os-installer-ed25519.pub)" = "$key"
test "$(wc -l <"$air_image.sha256" | tr -d '[:space:]')" = 1
checksum_line="$(cat "$air_image.sha256")"; checksum_digest="${checksum_line%%  *}"; checksum_name="${checksum_line#*  }"
[[ "$checksum_digest" =~ ^[0-9a-f]{64}$ ]]; test "$checksum_line" = "$checksum_digest  $air_image"; test "$checksum_name" = "$air_image"
checksum_size="$(stat -c '%s' "$air_image.sha256")"; checksum_sha="$(sha256sum "$air_image.sha256" | awk '{print $1}')"
provenance_size="$(stat -c '%s' "$air_image.provenance")"; provenance_sha="$(sha256sum "$air_image.provenance" | awk '{print $1}')"
verifier_size="$(stat -c '%s' "$air_image.verify.sh")"; verifier_sha="$(sha256sum "$air_image.verify.sh" | awk '{print $1}')"
printf 'AIR_OS_INSTALLER_SIGNATURE_V2\nname=%s.sha256\nsize=%s\nsha256=%s\nprovenance_name=%s.provenance\nprovenance_size=%s\nprovenance_sha256=%s\nverifier_name=%s.verify.sh\nverifier_size=%s\nverifier_sha256=%s\n' "$air_image" "$checksum_size" "$checksum_sha" "$air_image" "$provenance_size" "$provenance_sha" "$air_image" "$verifier_size" "$verifier_sha" >"$air_verify_tmp/statement"
signature="$(tr -d '\r\n' <"$air_image.sha256.sig")"; [[ "$signature" =~ ^[A-Za-z0-9+/]{86}==$ ]]
printf '%s' "$signature" | openssl base64 -d -A -out "$air_verify_tmp/signature.bin"; test "$(wc -c <"$air_verify_tmp/signature.bin")" = 64
printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00' >"$air_verify_tmp/public.der"; for ((offset=0; offset<64; offset+=2)); do printf "\\x${key:offset:2}"; done >>"$air_verify_tmp/public.der"
openssl pkeyutl -verify -pubin -keyform DER -inkey "$air_verify_tmp/public.der" -rawin -in "$air_verify_tmp/statement" -sigfile "$air_verify_tmp/signature.bin"
air_fetch "$air_image" 8589934592
test "$(sha256sum "$air_image" | awk '{print $1}')" = "$checksum_digest"
printf 'Verified image retained at %s/%s\n' "$air_download_dir" "$air_image"
)

(
set -euo pipefail
umask 077
export AIR_INSTALLER_PUBKEY=f79ecbda6904e34556616c7a537dea8740609b19f07a556b9eb783d7751838fb
air_verify_tmp="$(mktemp -d ./.air-n100-verify.XXXXXX)"; trap 'rm -rf -- "$air_verify_tmp"' EXIT
air_fetch() {
  local f="$1" max="$2" size partial="$air_verify_tmp/download.part"
  rm -f -- "$partial"
  if ! curl --proto '=https' --tlsv1.2 --fail --location --show-error --max-filesize "$max" "https://air.airdroper.org/downloads/$f" | head -c "$((max + 1))" >"$partial"; then rm -f -- "$partial"; return 1; fi
  size="$(stat -c '%s' "$partial")"
  if ! [[ "$size" =~ ^[0-9]+$ ]] || test "$size" -le 0 || test "$size" -gt "$max"; then rm -f -- "$partial"; return 1; fi
  mv -f -- "$partial" "$f"
}
air_fetch air-os-n100-latest.tar.xz.sha256 65536
air_fetch air-os-n100-latest.tar.xz.sig 256
air_fetch air-os-installer-ed25519.pub 128
key="${AIR_INSTALLER_PUBKEY,,}"; test "$(tr -d '\r\n' < air-os-installer-ed25519.pub)" = "$key"
test "$(wc -l < air-os-n100-latest.tar.xz.sha256 | tr -d '[:space:]')" = 1
checksum_line="$(cat air-os-n100-latest.tar.xz.sha256)"; checksum_digest="${checksum_line%%  *}"
test "$checksum_line" = "$checksum_digest  air-os-n100-latest.tar.xz"; [[ "$checksum_digest" =~ ^[0-9a-f]{64}$ ]]
tr -d '\r\n' < air-os-n100-latest.tar.xz.sig | openssl base64 -d -A -out package.sig.bin
test "$(wc -c < package.sig.bin)" -eq 64
printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00' > installer-public.der
for ((i=0; i<64; i+=2)); do printf "\\x${key:i:2}"; done >> installer-public.der
air_fetch air-os-n100-latest.tar.xz 8589934592
name=air-os-n100-latest.tar.xz; size="$(stat -c '%s' "$name")"; sha="$(sha256sum "$name" | awk '{print $1}')"
printf 'AIR_OS_INSTALLER_SIGNATURE_V1\nname=%s\nsize=%s\nsha256=%s\n' "$name" "$size" "$sha" > package.signature-input
openssl pkeyutl -verify -pubin -keyform DER -inkey installer-public.der -rawin -in package.signature-input -sigfile package.sig.bin
test "$sha" = "$checksum_digest"
)

$approvedSignerSha256 = (Read-Host 'Paste the independently approved 64-hex signer SHA-256').Trim().ToLowerInvariant()
if ($approvedSignerSha256 -cnotmatch '^[0-9a-f]{64}$') { throw 'No approved signer fingerprint supplied' }
Invoke-WebRequest https://air.airdroper.org/downloads/air-viewer-latest.exe -OutFile air-viewer-latest.exe
Invoke-WebRequest https://air.airdroper.org/downloads/air-viewer-latest.exe.sha256 -OutFile air-viewer-latest.exe.sha256
$expected = (Get-Content .\air-viewer-latest.exe.sha256).Split()[0]
$actual = (Get-FileHash .\air-viewer-latest.exe -Algorithm SHA256).Hash.ToLowerInvariant()
if ($actual -ne $expected) { throw 'SHA-256 mismatch' }
$signature = Get-AuthenticodeSignature .\air-viewer-latest.exe
if ($signature.Status -ne 'Valid') { throw "Invalid publisher: $($signature.Status)" }
if ($null -eq $signature.SignerCertificate) { throw 'Missing signer certificate' }
if ($null -eq $signature.TimeStamperCertificate) { throw 'Missing trusted timestamp' }
$signerSha256 = $signature.SignerCertificate.GetCertHashString([System.Security.Cryptography.HashAlgorithmName]::SHA256).ToLowerInvariant()
if ($signerSha256 -cne $approvedSignerSha256) { throw 'Publisher fingerprint mismatch' }

$base = 'https://air.airdroper.org/downloads'
$recordText = (Invoke-WebRequest "$base/air-viewer-unsigned-current/release.txt").Content
$expectedKeys = @(
  'schema', 'version', 'source_revision', 'release_mode',
  'authenticode_status', 'authenticode_required', 'sha256', 'size_bytes',
  'approval_checksum_sha256', 'latest_checksum_sha256',
  'build_manifest_sha256', 'dependency_manifest_sha256', 'sbom_sha256',
  'security_evidence_sha256', 'update_trust_sha256', 'immutable_url',
  'build_generated_utc', 'warning'
)
$lines = $recordText.TrimEnd("`r", "`n").Split("`n")
if ($lines.Count -ne $expectedKeys.Count) { throw 'Invalid release record field count' }
$record = @{}
for ($i = 0; $i -lt $lines.Count; $i++) {
  if ($lines[$i] -cnotmatch '^([a-z][a-z0-9_]*)=(.+)$') { throw 'Invalid release record line' }
  $key = $Matches[1]; $value = $Matches[2]
  if ($key -cne $expectedKeys[$i] -or $record.ContainsKey($key)) { throw 'Invalid release record field order' }
  $record[$key] = $value
}
if ($record.schema -cne 'org.airdroper.air-viewer.public-unsigned.v3') { throw 'Invalid release schema' }
if ($record.immutable_url -cnotmatch '^https://air\.airdroper\.org/downloads/air-viewer-unsigned-releases/v[0-9]+\.[0-9]+\.[0-9]+/air-viewer\.exe$') { throw 'Unsafe immutable URL' }
$immutableBase = $record.immutable_url.Substring(0, $record.immutable_url.LastIndexOf('/'))
Invoke-WebRequest $record.immutable_url -OutFile air-viewer.exe
Invoke-WebRequest "$immutableBase/air-viewer.exe.sha256" -OutFile air-viewer.exe.sha256
$line = (Get-Content -Raw .\air-viewer.exe.sha256).TrimEnd("`r", "`n")
if ($line -cnotmatch '^([0-9a-f]{64})  air-viewer\.exe$') { throw 'Invalid checksum file' }
$sidecarHash = (Get-FileHash .\air-viewer.exe.sha256 -Algorithm SHA256).Hash.ToLowerInvariant()
if ($sidecarHash -cne $record.approval_checksum_sha256) { throw 'Checksum evidence mismatch' }
$actual = (Get-FileHash .\air-viewer.exe -Algorithm SHA256).Hash.ToLowerInvariant()
if ($actual -cne $Matches[1] -or $actual -cne $record.sha256) { throw 'SHA-256 mismatch' }
if ((Get-Item .\air-viewer.exe).Length -ne [int64]$record.size_bytes) { throw 'Size mismatch' }
$signature = Get-AuthenticodeSignature .\air-viewer.exe
if ($signature.Status -ne 'NotSigned') { throw "Unexpected signature state: $($signature.Status)" }
Write-Warning 'SHA-256 passed; this preview is intentionally unsigned and Windows cannot authenticate its publisher.'

curl -L -o air-viewer-android-latest.apk https://github.com/AirdroperUA/air-releases/releases/latest/download/air-viewer-android-latest.apk
curl -sS -L https://github.com/AirdroperUA/air-releases/releases/latest/download/air-viewer-android-latest.apk.sha256 | sha256sum -c -
apksigner verify --verbose --print-certs air-viewer-android-latest.apk
# Signer #1 certificate SHA-256 digest must be:
# 929906c64e87507d023f51365b7e0ed953753ebd484e9951aeb7827c3d44cee2