nicweyand
16c740a98f
Some checks failed
Standalone registry checks / check (push) Has been cancelled
62 lines
2.8 KiB
Markdown
62 lines
2.8 KiB
Markdown
# Public signed catalog
|
|
|
|
The v0.5.0 Forgejo release publishes the first immutable data generation that any
|
|
Site Registry consumer can verify and resolve:
|
|
|
|
- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.5.0>
|
|
- asset: `argand-site-registry-catalog-20260920-v1.tar.gz`
|
|
- asset SHA-256:
|
|
`d878fa057397effa5dc729d2fa3a689c8edd1f4112ef1326dd6131b3fdeab63e`
|
|
- generation pin:
|
|
`ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a`
|
|
|
|
The release also carries a checksum file and an OpenSSH signature under namespace
|
|
`argand-site-registry-release`. Verify it against
|
|
[`trust/public-catalog-20260920/publisher-allowed-signers`](../trust/public-catalog-20260920/publisher-allowed-signers).
|
|
The signed Git history is the independent channel for the trust root; do not learn
|
|
the only trusted key from the archive it authenticates.
|
|
|
|
```bash
|
|
sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256
|
|
ssh-keygen -Y verify \
|
|
-f trust/public-catalog-20260920/publisher-allowed-signers \
|
|
-I argand-site-registry-publisher-v1 \
|
|
-n argand-site-registry-release \
|
|
-s argand-site-registry-catalog-20260920-v1.tar.gz.sig \
|
|
< argand-site-registry-catalog-20260920-v1.tar.gz
|
|
```
|
|
|
|
After extraction, verify every member with `SHA256SUMS`, then authenticate the
|
|
generation and exact reviewer trust root:
|
|
|
|
```bash
|
|
argand-site-registry activate \
|
|
--generation public-release-v0.5.0/catalog \
|
|
--current current.json \
|
|
--allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
|
|
--allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
|
|
--identity argand-site-registry-publisher-v1
|
|
|
|
argand-site-registry resolve \
|
|
--generation public-release-v0.5.0/catalog \
|
|
--pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \
|
|
--query "yahoo mail"
|
|
```
|
|
|
|
## Scope and trust
|
|
|
|
This first catalog is deliberately small. Its disclosed policy uses one automated
|
|
evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact
|
|
endpoint observations are required, and source conflicts or dangerous drift need
|
|
two groups, so the single automated reviewer must abstain on those risks. Sticky
|
|
revocations and publisher/reviewer key separation remain enabled.
|
|
|
|
Consumers decide whether this policy is appropriate for their use. Preserve typed
|
|
abstentions, retain attribution, and apply independent malware and content policy.
|
|
Do not route to the first raw lookup result. High-risk or disputed catalogs should
|
|
use the unchanged two-human-reviewer reference policy.
|
|
|
|
The generation's approvals expire. Installing an immutable archive is not a promise
|
|
that every decision stays valid forever: use the resolver's requested time,
|
|
consume cumulative signed revocation feeds when published, and move to a newly
|
|
signed full generation before relying on renewed decisions.
|