FlowKeyOps
Start free
Documentation Secrets and Security

Verify the FlowKeyOps agent

Check that the agent you run is the one FlowKeyOps built: signatures, SHA-256 checksums and SBOMs, published openly.

The FlowKeyOps agent runs inside your own network, next to your automation runtime. You should not have to take our word for what it is. Every agent release from 0.32.1 onward is signed and published with SHA-256 checksums and a software bill of materials (SBOM), openly, with no account needed. Your security team can check any agent before it runs.

What is published for each version

  • The container image gitlab.flowkeyops.cloud/fko-public/fko-agent:<version>, signed with cosign, with an SPDX SBOM attached as a signed attestation.
  • Linux binaries (amd64 and arm64), a sha256sums.txt listing their checksums, and sha256sums.txt.sig, a signature over that list.
  • SBOMs for the image and for each binary (SPDX JSON).
  • Our public key, cosign.pub.

Download location for a version (replace <version>, for example 0.32.1):

https://gitlab.flowkeyops.cloud/api/v4/projects/168/packages/generic/fko-agent/<version>/<file>

The FlowKeyOps signing public key

The same key is published with every version. Compare the two; they must be identical.

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWJWg3Vd6l1aUGPYLiSxJcKAtp/29
uZsP7Ee7hjagExrdK8KNSCPBpFbRlpC1hbuLX9xiOgDBHYzpcOsn9gzKag==
-----END PUBLIC KEY-----

The private key never leaves a hardware-backed cloud key management service, and only our protected release pipeline can use it. Every signature it makes is logged.

Verify the container image

With cosign installed and the key saved as cosign.pub:

cosign verify --key cosign.pub --insecure-ignore-tlog 
  gitlab.flowkeyops.cloud/fko-public/fko-agent:0.32.1

A valid image prints “The cosign claims were validated”. To check the SBOM attestation as well:

cosign verify-attestation --key cosign.pub --insecure-ignore-tlog --type spdxjson 
  gitlab.flowkeyops.cloud/fko-public/fko-agent:0.32.1

--insecure-ignore-tlog is expected: our signatures are verified with the published key alone and are not uploaded to a public transparency log. Despite the flag’s name, it does not weaken the key check.

Verify a Linux binary

cosign verify-blob --key cosign.pub --insecure-ignore-tlog 
  --signature sha256sums.txt.sig sha256sums.txt
sha256sum --ignore-missing -c sha256sums.txt

The first command proves the checksum list came from FlowKeyOps. The second proves your binary matches it. The Linux (systemd) installer from the control panel downloads the binary for the version FlowKeyOps advertises and refuses to install it if its SHA-256 does not match the published list.

If verification fails

Do not run the agent. Delete the download and contact FlowKeyOps Support with the version, the file name and the command output. Do not include enrolment tokens or credentials.

Versions before 0.32.1

Agent versions before 0.32.1 were not signed. Use the panel’s update notice to move to a signed version.