# Public signed catalog

The v0.6.2 Forgejo release publishes the current immutable data generation that
Argand and any other Site Registry consumer can verify and resolve:

- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.6.2>
- asset: `argand-site-registry-catalog-v0.6.2.tar.gz`
- asset SHA-256:
  `48b0cdf453862d858c4bec6c564360e1309605e30af9aba1f54a9446b9bdbe41`
- generation pin:
  `5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309`

The release also carries a checksum file and an OpenSSH signature under namespace
`argand-site-registry-release`. Verify it against
[`trust/public-catalog-20260920/publisher-allowed-signers`](../trust/public-catalog-20260920/publisher-allowed-signers).
The signed Git history is the independent channel for the trust root; do not learn
the only trusted key from the archive it authenticates.

```bash
sha256sum --check argand-site-registry-catalog-v0.6.2.tar.gz.sha256
ssh-keygen -Y verify \
  -f trust/public-catalog-20260920/publisher-allowed-signers \
  -I argand-site-registry-publisher-v1 \
  -n argand-site-registry-release \
  -s argand-site-registry-catalog-v0.6.2.tar.gz.sig \
  < argand-site-registry-catalog-v0.6.2.tar.gz
```

After extraction, verify every member with `SHA256SUMS`, then authenticate the
generation and exact reviewer trust root:

```bash
argand-site-registry activate \
  --generation public-release-v0.6.2/catalog \
  --current current.json \
  --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
  --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
  --identity argand-site-registry-publisher-v1

argand-site-registry resolve \
  --generation public-release-v0.6.2/catalog \
  --pin 5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309 \
  --query "facebook"
```

## Scope and trust

The v0.6.2 catalog contains 976 entities, 1,062 official-site edges, 20,178
multilingual name facts, and Common Crawl Web Graph evidence for 840 domains that
already had imported identity assertions. Graph authority can prioritize review
and disambiguation, but cannot create an identity, official-site assertion,
review, vote, or redirect. The archive includes all 33 authenticated cold audit
objects referenced by the compact runtime generation.

The bounded Wikidata discovery input is broad but not a representative or
high-demand sample. Its query and selection metadata are included for audit; raw
discovery output is never approval.

The disclosed policy uses one automated evidence-gate reviewer group rather than
claiming human-review quorum. Fresh exact endpoint observations are required, and
source conflicts or dangerous drift need two groups, so the single automated
reviewer must abstain on those risks. Sticky revocations and
publisher/reviewer-key separation remain enabled.

Consumers decide whether this policy is appropriate for their use. Preserve typed
abstentions, retain attribution, and apply independent malware and content policy.
Do not route to the first raw lookup result. High-risk or disputed catalogs should
use the unchanged two-human-reviewer reference policy.

The generation's approvals expire. Installing an immutable archive is not a promise
that every decision stays valid forever: use the resolver's requested time,
consume cumulative signed revocation feeds when published, and move to a newly
signed full generation before relying on renewed decisions.

## Regular updates

The public source repository includes the same updater used to refresh candidate
generations. The example systemd timer runs weekly. It can download, authenticate,
import and build, but it holds no publisher key and cannot approve, sign or
activate a candidate. That separation lets any consumer automate evidence updates
without allowing a compromised downloader or changed upstream dataset to silently
change redirects.