Verify the Node runtime

Part of every Flagship server is written in TypeScript and runs on Node.js. Your server runs the official Node.js binary, exactly as the Node.js project publishes it at nodejs.org: never a copy we rebuilt. Below is the exact version and checksum each Flagship release locks, signed by Flagship's release keys, so you can check your server against it and check both against Node's own signed list.

What this proves, and what it does not. Matching checksums prove your server runs the same bytes the Node.js project signed and Flagship approved. They do not prove those bytes were built from Node's published source: that needs a reproducible build, a separate claim.

The current signed runtime manifest

Loading the signed manifest…

Runtime	Node.js
Flagship release
Security floor	(no Flagship server runs an older Node)
Sequence	(only ever goes up; a server refuses an older one)
Valid until	(a server stops trusting it after this date)
Lock digest
Node's signing key

Machine-readable signed manifest (JSON)

Check it yourself

1. Download the official archive and Node's signed checksum list, and check Node's signature with a key you got from github.com/nodejs/release-keys, not from us:

curl -fsSLO https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz
curl -fsSLO https://nodejs.org/dist/v24.22.1/SHASUMS256.txt
curl -fsSLO https://nodejs.org/dist/v24.22.1/SHASUMS256.txt.sig
gpg --verify SHASUMS256.txt.sig SHASUMS256.txt
grep ' node-v24.22.1-linux-x64.tar.gz$' SHASUMS256.txt
sha256sum node-v24.22.1-linux-x64.tar.gz

2. Check Flagship's signature on the manifest with the release keys pinned in the source repository (the key never comes from this site), and that the lock it carries is the one it signs:

curl -fsS https://flagshipserver.com/api/runtime/manifest -o runtime-manifest.json
jq -j .lockJson runtime-manifest.json | sha256sum    # equals manifest.lockSha256
git clone https://github.com/ibisllc/flagship && cd flagship && npm ci
npx tsx tools/box-artifact/runtime-manifest.ts verify --manifest ../runtime-manifest.json

3. On your own server (with debug access turned on from its page in the Flagship app), hash the Node that is running and compare it with the executable SHA-256 above:

sha256sum /opt/flagship/.runtime/node/bin/node
/opt/flagship/.runtime/node/bin/node --version

The Flagship app shows the same comparison on each server's page, under Runtime.

How a server uses it

The runtime lock (release/runtime-lock.json) is part of every signed release. A release whose bundled Node is not the locked binary is refused before it is switched on.
The server fetches this manifest, checks it against the release keys it already pins, refuses an older sequence or an expired manifest, and keeps the last one it accepted if this site is down. A missing manifest never stops a healthy server.
A new runtime is installed only when the archive's own checksum, Node's signed list and Flagship's signed manifest all agree; otherwise the running one stays.

The full design: the updater's runtime module.