Download `ceremony_tool`

Same binary the coordinator runs. Contributions never leave your machine until you upload the output files. Signed releases, reproducible builds.

Recommended for your system

Verify the download

Pick one or more of:

minisign — our release-signing pubkey is committed to this repo at .minisign/ceremony-tool.pub and also mirrored on Nostr.
```
minisign -Vm ceremony_tool \
  -P RWRV9yO9DwVctoMc0b9oT3vmt/6M0riHkSmnxmgt8LNi+KnW9PjsERDv \
  -x ceremony_tool.minisig
```

cosign (keyless) — verified against our GitHub Actions OIDC identity.

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/rinat-enikeev/stellar-mls/\.github/workflows/release-ceremony-tool\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --signature ceremony_tool.sig \
  --certificate ceremony_tool.pem \
  ceremony_tool

SHA-256 (weakest; use with one of the above):
```
sha256sum -c ceremony_tool.sha256
```

All artifacts

Build from source (reproducibly)

The release build runs inside a pinned Docker image with a fixed rustc. Any machine with Docker can rebuild and byte-identically reproduce the Linux artifacts:

git clone https://github.com/rinat-enikeev/stellar-mls
cd stellar-mls
./scripts/verify-ceremony-tool.sh vX.Y.Z x86_64-unknown-linux-musl

The script prints OK if your local rebuild matches the published unsigned SHA-256 in buildinfo.json. See ceremony-reproducible-build.md for the full methodology.

Source integrity

rustc: pinned in rust-toolchain.toml
Crate deps: Cargo.lock committed; build uses --locked
Release profile: [profile.release-ceremony] in root Cargo.toml
Path remap: --remap-path-prefix to strip build host
Environment: SOURCE_DATE_EPOCH from commit time; TZ=UTC; LC_ALL=C