Verify

Every Wren Linux update is signed by this key. After the install your computer checks it by itself, and refuses anything else. The first download is the one to check by hand.

DE09 E9B9 E956 5B2B DA9D 5FF5 F0F1 9D6C EF46 5DC5

Compare it in more than one place: this page, SECURITY.md, and this site's onion address, fvufmihsupx6clbhjitsjgnsskorxeaplrtqlkndscsmqkzk4tmx47yd.onion, in Tor Browser, and your copy (below). These all come from Wren Linux's own server: they catch a change on the way to you, not someone who took the server over. For that, compare it with someone who already uses Wren Linux.

In your copy (~/wren, from Install):

grep '^WREN_SIGNING_FPR=' ~/wren/pins.sh
gpg --show-keys --with-fingerprint ~/wren/data/wren-signing-key.asc
git -C ~/wren -c gpg.program=gpg verify-commit HEAD

The first two must both show the key above. For the third, first import the key (gpg --import ~/wren/data/wren-signing-key.asc); it must say "Good signature" from that key. If anything differs, don't run it: SECURITY.md says whom to tell.