[question] How to validate the downloaded software authenticity?

[epoberezkin]

E.g., by validating downloaded software hash and/or signature.

[emlun]

Hi! Signatures are included in the release channels listed in the README and at developers.yubico.com. Release signing keys are also listed on developers.yubico.com.

[epoberezkin]

Thank you, to be more precise, I was looking to validate signature for appimage that is available via the website, and it's not available in the release page.

[emlun]

In that case I assume you mean the YubiKey Manager GUI, not the CLI (which is what's hosted in this repository). Those releases and their signatures are listed here. However, for most use cases I would recommend using Yubico Authenticator instead, which now has almost all the capabilities of the YubiKey Manager GUI.

[epoberezkin]

thank you!