Skip to main content
Version: 1.1.x

Artifacts Verification

All Coryn AI Android SDK release artifacts are digitally signed using OpenPGP (PGP). The following file types are signed for every release:

  • .aar
  • .pom
  • .module

Each artifact is accompanied by a detached .asc signature file. For example:

core-1.1.122.aar
core-1.1.122.aar.asc

core-1.1.122.pom
core-1.1.122.pom.asc

core-1.1.122.module
core-1.1.122.module.asc

Release artifacts also include cryptographic checksum files, including SHA-256 and SHA-512.

Checksums verify that the downloaded file has not changed. The OpenPGP signature additionally allows you to verify that the artifact was signed by the Coryn AI Android SDK release key.

Signing identity​

Coryn AI (Android SDK) <[email protected]>

PGP fingerprint​

C18F F410 34DC 03AE A8C4  0F8E 17D1 C025 658A 23D1
Verify the fingerprint

Before trusting the public signing key, confirm that its fingerprint exactly matches the value shown above. Always use the complete 40-character fingerprint when configuring automated verification.

Public key​

The public OpenPGP key is available over HTTPS:

https://nexus.coryn.ai/repository/public-static/android/coryn-ai-android-signing-public-key.asc

Download the key:

curl -O \
  https://nexus.coryn.ai/repository/public-static/android/coryn-ai-android-signing-public-key.asc

Inspect its fingerprint before trusting it:

gpg --show-keys --fingerprint \
  coryn-ai-android-signing-public-key.asc

The fingerprint must be:

C18F F410 34DC 03AE A8C4  0F8E 17D1 C025 658A 23D1

After verifying the fingerprint, import the key:

gpg --import coryn-ai-android-signing-public-key.asc

Manual artifact verification​

Download both the artifact and its detached .asc signature from the Coryn Maven repository. For example:

core-1.1.122.aar
core-1.1.122.aar.asc

Verify the signature with GnuPG:

gpg --verify core-1.1.122.aar.asc core-1.1.122.aar

A successful verification confirms that:

  1. the artifact has not been modified since it was signed; and
  2. the signature was produced by the private key corresponding to the Coryn AI release public key.

You should still verify that the signing key fingerprint matches the fingerprint published on this page.

Checksum verification​

SHA-256 and SHA-512 checksums are published alongside release artifacts. For example:

core-1.1.122.aar
core-1.1.122.aar.sha256
core-1.1.122.aar.sha512

On Linux:

sha256sum core-1.1.122.aar

On macOS:

shasum -a 256 core-1.1.122.aar

Compare the resulting digest with the contents of core-1.1.122.aar.sha256.

Checksums are useful for integrity verification, but they do not by themselves establish who published an artifact. Use the OpenPGP signature when authenticity is required.

Gradle Dependency Verification​

Gradle Dependency Verification can automatically verify Coryn SDK artifacts during dependency resolution. It consists of two parts:

  1. making the Coryn public key available to Gradle; and
  2. explicitly trusting the Coryn signing fingerprint for the relevant Maven coordinates.

Add the Coryn key to the Gradle keyring​

Download the public key and append it to gradle/verification-keyring.keys:

curl -fsSL \
  https://nexus.coryn.ai/repository/public-static/android/coryn-ai-android-signing-public-key.asc \
  >> gradle/verification-keyring.keys

The .keys file uses the ASCII-armored keyring format supported by Gradle. Commit the keyring with your dependency verification configuration so developers and CI use the same trusted key material.

Enable signature verification​

Configure dependency verification in gradle/verification-metadata.xml. The following configuration scopes trust for Coryn artifacts; merge it into your existing verification metadata rather than replacing verification rules for other dependencies:

<?xml version="1.0" encoding="UTF-8"?>
<verification-metadata
    xmlns="https://schema.gradle.org/dependency-verification"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="
        https://schema.gradle.org/dependency-verification
        https://schema.gradle.org/dependency-verification/dependency-verification-1.4.xsd">

    <configuration>
        <verify-metadata>true</verify-metadata>
        <verify-signatures>true</verify-signatures>
        <keyring-format>armored</keyring-format>

    <trusted-keys>
        <trusted-key
            id="C18FF41034DC03AEA8C40F8E17D1C025658A23D1"
            group="^ai[.]coryn[.]replay([.].*)?$"
            regex="true"/>
    </trusted-keys>
    </configuration>

</verification-metadata>

Using a group-scoped trusted key ensures the Coryn signing key is trusted for Coryn artifacts rather than globally for unrelated dependencies.

Gradle requires the complete OpenPGP fingerprint for trusted keys:

C18FF41034DC03AEA8C40F8E17D1C025658A23D1

Do not configure trust using only a short or long key ID.

See Gradle's dependency-verification documentation for additional options.

Key rotation​

Signing keys may be rotated over time. Previous releases remain verifiable using the key that was current when those releases were published.

Before a new signing key is used for a release, its public key, full OpenPGP fingerprint, and effective release/version range will be published on this page. Historical public keys will remain available so older releases can continue to be verified.

Key compromise or revocation​

If a Coryn Android SDK signing key is revoked or suspected to be compromised, this page will be updated with:

  • the affected key fingerprint;
  • its revocation status;
  • the affected release range, where known; and
  • the fingerprint and public key of its replacement.

Do not trust a replacement key solely because it is served from the same Maven repository. Verify its fingerprint against the value published on this page before adding it to your trusted keyring.

Software Bill of Materials (SBOM)​

Coryn AI Android SDK releases include a CycloneDX Software Bill of Materials (SBOM) in JSON format, describing the software components and runtime dependencies of the published Android artifact.

The SBOM is published alongside the release artifact using the cyclonedx classifier and is accompanied by a detached OpenPGP signature and SHA-256/SHA-512 checksum files:

core-1.1.122-cyclonedx.json
core-1.1.122-cyclonedx.json.asc
core-1.1.122-cyclonedx.json.sha256
core-1.1.122-cyclonedx.json.sha512

Verify the SBOM signature using the same Coryn AI Android SDK signing key:

gpg --verify \
  core-1.1.122-cyclonedx.json.asc \
  core-1.1.122-cyclonedx.json

The SBOM follows the CycloneDX specification and can be consumed by compatible software composition analysis, vulnerability scanning, dependency inventory, and supply-chain security tooling.

An SBOM is an inventory, not a guarantee that dependencies are free of vulnerabilities. Scan the SBOM for the version you deploy against your current vulnerability database.