Install Tessallite from one signed self-hosted bundle.

# Step 1: download the archive and its two detached verification files.
# The companion filenames append to the FULL archive name, so the checksum
# manifest names the .tar.gz itself and can be checked before extracting.
V=X.Y.Z
curl -LO https://downloads.tessallite.io/tessallite-community-$V.tar.gz
curl -LO https://downloads.tessallite.io/tessallite-community-$V.tar.gz.SHA256SUMS
curl -LO https://downloads.tessallite.io/tessallite-community-$V.tar.gz.SHA256SUMS.sig

# Step 2: verify the archive integrity BEFORE extracting.
# The manifest is a single `sha256sum -c` line covering the archive itself.
sha256sum -c tessallite-community-$V.tar.gz.SHA256SUMS

# Step 3: verify the release signature over the exact manifest bytes.
# Prerequisite: pip install cryptography
# The .sig file is two lines: the signing key id, then the base64 signature.
pip install cryptography
python3 - "$V" <<'PY'
import base64, sys
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
V = sys.argv[1]
PUB = "/by3PGaeLD425bBkMrAbD2NeHROHyjLHVA37pS5w3+0="
sig = base64.b64decode(
    open(f"tessallite-community-{V}.tar.gz.SHA256SUMS.sig").read().splitlines()[1])
Ed25519PublicKey.from_public_bytes(base64.b64decode(PUB)).verify(
    sig,
    open(f"tessallite-community-{V}.tar.gz.SHA256SUMS", "rb").read(),
)
print("signature OK -- safe to extract")
PY

# Step 4: extract only after both checks pass.
tar -xzf tessallite-community-$V.tar.gz