Your appliance images.
Each release lists both disk formats with the published SHA-256 and signature. Pick the format your hypervisor imports, then verify it with the steps below before you deploy.
Prove we built it.
An appliance image runs your venue. Don’t trust it because it came from a Mediacast URL — trust it because the signature checks out. Two steps: a checksum to catch a bad download, and a signature to prove provenance.
Checksum — catch a corrupt download
Compute the SHA-256 of the file you downloaded and compare it to the value shown with the download (also in the release’s install-media-manifest.json). They must match exactly.
# Point IMAGE at the file you downloaded, e.g. # castedge-appliance-<version>.ova or mediacaster-appliance-<version>.qcow2 IMAGE=<the-file-you-downloaded> sha256sum "$IMAGE" # macOS: shasum -a 256 "$IMAGE" # Compare the output to the SHA-256 shown on this page.
Signature — prove Mediacast built it
The signature is an ECDSA-P256 signature over the file’s SHA-256 digest, made with the Mediacast release key (kid release-2026) — the same key every appliance uses to verify its own in-place updates. Rebuild the public key from our first-party keyring and verify. Verified OK means the bytes are genuinely ours.
# 1. Fetch the public key (served first-party over TLS):
curl -s https://www.mediacastnet.com/.well-known/mediacast-release-keys.json \
| python3 -c 'import sys,json;print(json.load(sys.stdin)["release-2026"])' > point.b64
# 2. Rebuild the P-256 public key as a PEM:
python3 - "$(cat point.b64)" > pub.der <<'PY'
import sys, base64
point = base64.b64decode(sys.argv[1])
open(1,'wb').write(bytes.fromhex('3059301306072a8648ce3d020106082a8648ce3d030107034200') + point)
PY
openssl pkey -pubin -inform DER -in pub.der -out pub.pem
# 3. Verify the signature (shown with the download) over the file's sha256 hex:
IMAGE=<the-file-you-downloaded>
SHA=$(sha256sum "$IMAGE" | cut -d' ' -f1) # macOS: shasum -a 256 "$IMAGE" | cut -d' ' -f1
printf '%s' "$SHA" > digest.txt
printf '%s' '<signature-base64-from-this-page>' | base64 -d > sig.der
openssl dgst -sha256 -verify pub.pem -signature sig.der digest.txt
# -> Verified OK
The public key is published at /.well-known/mediacast-release-keys.json. The private key never leaves our KMS — we can sign, no one can forge.
Pick your format.
OVA — VMware
Imports into ESXi, vCenter, and Workstation 6.7+. Deploy the OVA, then paste your per-appliance cloud-init userdata into vApp Options → user-data (or set guestinfo.userdata via govc). Size and network the VM per your product’s deploy guide — 4 vCPU / 8 GB is the usual floor.
QCOW2 — Proxmox / KVM
Use the QCOW2 directly on Proxmox, KVM, or libvirt. Provide cloud-init userdata through the platform’s NoCloud datasource (on Proxmox, the cloud-init drive). Same cloud-init identity contract as the OVA — one image, one binding.
Your deploy guide is in your onboarding bundle. Sizing, firewall rules, the cloud-init userdata with your appliance’s binding values, and the step-by-step import procedure are all product- and site-specific — Mediacast delivers them with your bundle rather than publishing them here. Deploy from that guide, not from this page. Don’t have it? Contact us.