Static binaries, no installer, no runtime dependencies. The musl pair runs on any Linux (glibc or not); the Windows build is compile-verified and run-verified under wine. macOS is not published yet.
| File | Platform | Size | SHA-256 |
|---|---|---|---|
dependencies.txt |
Shipped dependency tree | 2 KiB | 02bad75570f29ea1329cc57ff136c708878396dcfd6f1a41ec6348f9da633481 |
LICENSE.txt |
Licence (binding terms) | 9 KiB | f85d78a2ea34ef7572690f6d3e3a19c247339408761a5b38a6c9ab247ff4563d |
ssh-key-audit-aarch64-linux-musl |
Linux aarch64 · static (musl) | 815 KiB | 03a91757caaf0fd1c1b81c50b9353d4568ee11df9c7bba8e9832fb18b3a58b9b |
ssh-key-audit-x86_64-linux-musl |
Linux x86_64 · static (musl) | 783 KiB | ec58b9d47a1059ebb528cc41a3e75e232da29cf863f1f8fc85c7d924524444ee |
ssh-key-audit-x86_64-windows.exe |
Windows x86_64 | 1.87 MiB | eef3daa344f985d0c7f5c3b652f021a2e473213fa2bad54c09edd2a4fff21825 |
ssh-key-monitor.cdx.json |
SBOM (CycloneDX) | 68 KiB | 0dec6a9cd5db4c707276690215444dbf9eff153149547f54e8671241c60b94f6 |
sha256sums.txt |
SHA-256 checksums | 735 B | ec5c780f01dfc329fbc48a9e5dd3cdc2e7cc74178214b09f86cb7aecd4a542bc |
sha256sums.txt covers the full GitHub Release asset set; the gnu Linux pair is not mirrored here (it links a nix store interpreter and only runs in nix environments).
Free for individuals, open source and education, with no
limit on the number of machines; one flat annual price per
organisation above that.
Every feature ships in every build, nothing phones home, and we
never count machines. The binding terms are the
licence, also shipped beside
these binaries in the release assets as
LICENSE.txt.
This is a claim you can falsify in one command. The binary has no network client linked into it at all, so watching its syscalls is the whole proof:
strace -f -e trace=network ./ssh-key-audit-x86_64-linux-musl ~/.ssh /etc/ssh # no socket(), connect() or sendto() lines: there is no network code to run
On macOS use sudo dtruss -t socket instead; the
result is the same. The empty trace is structural, not lucky: the
shipped dependency tree contains no HTTP, TLS, DNS or socket
library at all — no mio, no socket2, no rustls, no reqwest, just
hashing, encoding, serialization and a runtime. Confirm it two
ways: dependencies.txt is the exact tree of the
binary you downloaded, and the CycloneDX SBOM lists every crate
in the project (tests and build scripts included) by name,
version and licence. Neither contains a networking crate,
because there is none to list.
Every artifact is signed with the project's minisign key. Verifying the signature first is what makes the checksums trustworthy: it proves the checksums themselves came from us.
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/sha256sums.txt curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/sha256sums.txt.minisig minisign -Vm sha256sums.txt -P RWRXGtO/l3ljO2NH7SxtEZEsgpqLm7k2nSaaw2Brth7YpgeMi+UI6PBE
Then verify the artifact you downloaded against those checksums
(sha256sum -c --ignore-missing sha256sums.txt).
Install minisign with your package manager, or from
jedisct1.github.io/minisign;
it needs no network access to check a signature.
./ssh-key-audit-x86_64-linux-musl home/.ssh etc/ssh etc/ssh/ssh_host_ed25519_key private_key ssh-ed25519 SHA256:evKnVLolqQtVkd3USueNPNdTHvn3Qrrnz3yAXcG8mko 256 "host" (600) etc/ssh/ssh_host_ed25519_key.pub public_key ssh-ed25519 SHA256:evKnVLolqQtVkd3USueNPNdTHvn3Qrrnz3yAXcG8mko 256 "host" (644) home/.ssh/authorized_keys authorized_keys ssh-ed25519 SHA256:b3qKGeDjn7vlC0pRb2C7jMrI9rJbC6ESs68t8WInVGg 256 "lars@workstation" (644) home/.ssh/authorized_keys authorized_keys ssh-ed25519 SHA256:yYH5mEPAv84wjrYKsueCjZZOQJgMlIzsT0xzq/3MdKg 256 "deploy@ci" (644) home/.ssh/deploy_key private_key ssh-ed25519 SHA256:yYH5mEPAv84wjrYKsueCjZZOQJgMlIzsT0xzq/3MdKg 256 "deploy@ci" (600) home/.ssh/deploy_key.pub public_key ssh-ed25519 SHA256:yYH5mEPAv84wjrYKsueCjZZOQJgMlIzsT0xzq/3MdKg 256 "deploy@ci" (644) home/.ssh/id_ed25519 private_key ssh-ed25519 SHA256:b3qKGeDjn7vlC0pRb2C7jMrI9rJbC6ESs68t8WInVGg 256 "lars@workstation" (600) home/.ssh/id_ed25519.pub public_key ssh-ed25519 SHA256:b3qKGeDjn7vlC0pRb2C7jMrI9rJbC6ESs68t8WInVGg 256 "lars@workstation" (644) home/.ssh/known_hosts known_hosts 1 host ssh-ed25519 SHA256:evKnVLolqQtVkd3USueNPNdTHvn3Qrrnz3yAXcG8mko 256 (644) INSECURE home/.ssh/leaky_priv private_key ssh-ed25519 SHA256:KZiejCe4zjexTDqU5ABeXO2sqH2xONTFwqBZyNB9nck 256 "leaky" (644) home/.ssh/leaky_priv.pub public_key ssh-ed25519 SHA256:KZiejCe4zjexTDqU5ABeXO2sqH2xONTFwqBZyNB9nck 256 "leaky" (644) home/.ssh/legacy_rsa private_key ssh-rsa SHA256:xRJNMjyshGGY8xZf9Qc9zHJeSDJD25UYSsb/wTRTWIM 3072 "legacy" (600) home/.ssh/legacy_rsa.pub public_key ssh-rsa SHA256:xRJNMjyshGGY8xZf9Qc9zHJeSDJD25UYSsb/wTRTWIM 3072 "legacy" (644) scanned 13 key(s), 1 insecure
Real output from a real run against a test machine: every key
on one line — path, kind, algorithm, an
ssh-keygen -lf-compatible fingerprint, key size,
comment, permissions — with weak permissions flagged and
known_hosts entries showing how many hosts they cover. Add
--json for one machine-readable document,
--fail-on-insecure to fail cron jobs and CI when
anything is insecure.
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/ssh-key-audit-x86_64-linux-musl curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/sha256sums.txt sha256sum -c --ignore-missing sha256sums.txt && chmod +x ssh-key-audit-x86_64-linux-musl ./ssh-key-audit-x86_64-linux-musl ~/.ssh /etc/ssh
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/ssh-key-audit-aarch64-linux-musl curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/sha256sums.txt sha256sum -c --ignore-missing sha256sums.txt && chmod +x ssh-key-audit-aarch64-linux-musl ./ssh-key-audit-aarch64-linux-musl ~/.ssh /etc/ssh
The aarch64 binary is fully static — the same download runs
on Raspberry Pi-class ARM boards and ARM servers. On an
x86_64 host you can smoke it under qemu-user before
deploying:
qemu-aarch64 ./ssh-key-audit-aarch64-linux-musl --version.
curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/ssh-key-audit-x86_64-windows.exe curl -LO https://ssh-key-monitor.artmann.tech/download/v0.5.0/sha256sums.txt certutil -hashfile ssh-key-audit-x86_64-windows.exe SHA256 ssh-key-audit-x86_64-windows.exe %USERPROFILE%\.ssh
Compare the certutil hash against the
ssh-key-audit-x86_64-windows.exe line in
sha256sums.txt. Windows builds report no permission modes —
the POSIX permission model does not apply there — so
INSECURE flags are POSIX platforms only; on Windows the
audit is an inventory of keys and identities.
The first scan is the audit — it prints every key found. Every scan after it reports the diff. No key material is ever logged, transmitted, or included in the output hashes.