Britive Downloads

Signing keys

Britive ships two signing keys. The GPG key signs .deb, .rpm, .pkg.tar.zst, every repo metadata file (Release, repomd, britive.db), and every SHA256SUMS manifest. The apk RSA key signs APKINDEX.tar.gz for Alpine — apk-tools doesn't speak OpenPGP, so it needs its own key. Both are env-scoped.

Verify the GPG fingerprint before you trust the key. The authoritative fingerprint is published in the Britive Customer Support Portal; you can also confirm it with your Customer Success contact. A convenience copy is served at https://download.britive.com/keys/britive.gpg.fingerprint, but because it shares an origin with the key itself it cannot anchor trust on its own — always compare against the Support Portal value.

Trust the GPG key (apt)

curl -fsSL https://download.britive.com/keys/britive.gpg | sudo gpg --dearmor -o /usr/share/keyrings/britive.gpg

Trust the GPG key (rpm / dnf)

sudo rpm --import https://download.britive.com/keys/britive.gpg

Trust the GPG key (pacman)

curl -fsSL https://download.britive.com/keys/britive.gpg | sudo pacman-key --add /dev/stdin
sudo pacman-key --lsign-key packaging@britive.com

Trust the apk RSA key (Alpine)

sudo wget -O /etc/apk/keys/packaging@britive.com.rsa.pub https://download.britive.com/keys/packaging@britive.com.rsa.pub

Print the GPG fingerprint (compare against the Support Portal value)

curl -fsSL https://download.britive.com/keys/britive.gpg | gpg --show-keys --with-fingerprint

Verify a GPG detached signature

curl -fsSL https://download.britive.com/keys/britive.gpg | gpg --import
gpg --verify <artifact>.asc <artifact>

Name	Size	Last modified	SHA-256
..	—	—	—
SHA256SUMS	372 B	2026-09-15T18:20:14Z	—
SHA256SUMS.asc	833 B	2026-09-15T18:20:14Z	—
britive.gpg	1.6 KB	2026-09-15T18:17:59Z
britive.gpg.fingerprint	128 B	2026-09-15T18:17:59Z
packaging@britive.com.rsa.pub	451 B	2026-09-15T18:20:12Z
packaging@britive.com.rsa.pub.fingerprint	123 B	2026-09-15T18:20:12Z