Starlink Video Link
for UAVs

Authenticate the checksum with the independently pinned AirOS release key before trusting the image. The AIR_OS_INSTALLER_SIGNATURE_V2 statement also binds the provenance and adjacent verifier bytes. The fail-closed inline bootstrap authenticates them without executing code from the download mirror.

(
set -euo pipefail
umask 077
AIR_INSTALLER_PUBKEY=f79ecbda6904e34556616c7a537dea8740609b19f07a556b9eb783d7751838fb
air_image=air-os-latest.img.xz
air_download_dir="$(pwd)/air-os-verified"; mkdir -- "$air_download_dir"; cd -- "$air_download_dir"
air_verify_tmp="$(mktemp -d ./verify.XXXXXX)"; trap 'rm -rf -- "$air_verify_tmp"' EXIT
air_fetch() {
  local f="$1" max="$2" size partial="$air_verify_tmp/download.part"
  rm -f -- "$partial"
  if ! curl --proto '=https' --tlsv1.2 --fail --location --show-error --max-filesize "$max" "https://air.airdroper.org/downloads/$f" | head -c "$((max + 1))" >"$partial"; then rm -f -- "$partial"; return 1; fi
  size="$(stat -c '%s' "$partial")"
  if ! [[ "$size" =~ ^[0-9]+$ ]] || test "$size" -le 0 || test "$size" -gt "$max"; then rm -f -- "$partial"; return 1; fi
  mv -f -- "$partial" "$f"
}
air_fetch "$air_image.sha256" 65536
air_fetch "$air_image.sha256.sig" 256
air_fetch "$air_image.provenance" 1048576
air_fetch "$air_image.verify.sh" 1048576
air_fetch air-os-installer-ed25519.pub 128
key="${AIR_INSTALLER_PUBKEY,,}"; test "$(tr -d '\r\n' < air-os-installer-ed25519.pub)" = "$key"
test "$(wc -l <"$air_image.sha256" | tr -d '[:space:]')" = 1
checksum_line="$(cat "$air_image.sha256")"; checksum_digest="${checksum_line%%  *}"; checksum_name="${checksum_line#*  }"
[[ "$checksum_digest" =~ ^[0-9a-f]{64}$ ]]; test "$checksum_line" = "$checksum_digest  $air_image"; test "$checksum_name" = "$air_image"
checksum_size="$(stat -c '%s' "$air_image.sha256")"; checksum_sha="$(sha256sum "$air_image.sha256" | awk '{print $1}')"
provenance_size="$(stat -c '%s' "$air_image.provenance")"; provenance_sha="$(sha256sum "$air_image.provenance" | awk '{print $1}')"
verifier_size="$(stat -c '%s' "$air_image.verify.sh")"; verifier_sha="$(sha256sum "$air_image.verify.sh" | awk '{print $1}')"
printf 'AIR_OS_INSTALLER_SIGNATURE_V2\nname=%s.sha256\nsize=%s\nsha256=%s\nprovenance_name=%s.provenance\nprovenance_size=%s\nprovenance_sha256=%s\nverifier_name=%s.verify.sh\nverifier_size=%s\nverifier_sha256=%s\n' "$air_image" "$checksum_size" "$checksum_sha" "$air_image" "$provenance_size" "$provenance_sha" "$air_image" "$verifier_size" "$verifier_sha" >"$air_verify_tmp/statement"
signature="$(tr -d '\r\n' <"$air_image.sha256.sig")"; [[ "$signature" =~ ^[A-Za-z0-9+/]{86}==$ ]]
printf '%s' "$signature" | openssl base64 -d -A -out "$air_verify_tmp/signature.bin"; test "$(wc -c <"$air_verify_tmp/signature.bin")" = 64
printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00' >"$air_verify_tmp/public.der"; for ((offset=0; offset<64; offset+=2)); do printf "\\x${key:offset:2}"; done >>"$air_verify_tmp/public.der"
openssl pkeyutl -verify -pubin -keyform DER -inkey "$air_verify_tmp/public.der" -rawin -in "$air_verify_tmp/statement" -sigfile "$air_verify_tmp/signature.bin"
air_fetch "$air_image" 8589934592
test "$(sha256sum "$air_image" | awk '{print $1}')" = "$checksum_digest"
printf 'Verified image retained at %s/%s\n' "$air_download_dir" "$air_image"
)

(
set -euo pipefail
umask 077
export AIR_INSTALLER_PUBKEY=f79ecbda6904e34556616c7a537dea8740609b19f07a556b9eb783d7751838fb
air_verify_tmp="$(mktemp -d ./.air-n100-verify.XXXXXX)"; trap 'rm -rf -- "$air_verify_tmp"' EXIT
air_fetch() {
  local f="$1" max="$2" size partial="$air_verify_tmp/download.part"
  rm -f -- "$partial"
  if ! curl --proto '=https' --tlsv1.2 --fail --location --show-error --max-filesize "$max" "https://air.airdroper.org/downloads/$f" | head -c "$((max + 1))" >"$partial"; then rm -f -- "$partial"; return 1; fi
  size="$(stat -c '%s' "$partial")"
  if ! [[ "$size" =~ ^[0-9]+$ ]] || test "$size" -le 0 || test "$size" -gt "$max"; then rm -f -- "$partial"; return 1; fi
  mv -f -- "$partial" "$f"
}
air_fetch air-os-n100-latest.tar.xz.sha256 65536
air_fetch air-os-n100-latest.tar.xz.sig 256
air_fetch air-os-installer-ed25519.pub 128
key="${AIR_INSTALLER_PUBKEY,,}"; test "$(tr -d '\r\n' < air-os-installer-ed25519.pub)" = "$key"
test "$(wc -l < air-os-n100-latest.tar.xz.sha256 | tr -d '[:space:]')" = 1
checksum_line="$(cat air-os-n100-latest.tar.xz.sha256)"; checksum_digest="${checksum_line%%  *}"
test "$checksum_line" = "$checksum_digest  air-os-n100-latest.tar.xz"; [[ "$checksum_digest" =~ ^[0-9a-f]{64}$ ]]
tr -d '\r\n' < air-os-n100-latest.tar.xz.sig | openssl base64 -d -A -out package.sig.bin
test "$(wc -c < package.sig.bin)" -eq 64
printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00' > installer-public.der
for ((i=0; i<64; i+=2)); do printf "\\x${key:i:2}"; done >> installer-public.der
air_fetch air-os-n100-latest.tar.xz 8589934592
name=air-os-n100-latest.tar.xz; size="$(stat -c '%s' "$name")"; sha="$(sha256sum "$name" | awk '{print $1}')"
printf 'AIR_OS_INSTALLER_SIGNATURE_V1\nname=%s\nsize=%s\nsha256=%s\n' "$name" "$size" "$sha" > package.signature-input
openssl pkeyutl -verify -pubin -keyform DER -inkey installer-public.der -rawin -in package.signature-input -sigfile package.sig.bin
test "$sha" = "$checksum_digest"
)

curl -L -o air-viewer-android-latest.apk https://github.com/AirdroperUA/air-releases/releases/latest/download/air-viewer-android-latest.apk
curl -sS -L https://github.com/AirdroperUA/air-releases/releases/latest/download/air-viewer-android-latest.apk.sha256 | sha256sum -c -
apksigner verify --verbose --print-certs air-viewer-android-latest.apk
# Signer #1 certificate SHA-256 digest must be:
# 929906c64e87507d023f51365b7e0ed953753ebd484e9951aeb7827c3d44cee2