nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions
argand-site-registry/docs/PUBLIC_CATALOG.md
nicweyand 16c740a98f
Some checks failed
Standalone registry checks / check (push) Has been cancelled
Details
Publish first signed Site Registry catalog trust
2026-09-20 11:57:47 -04:00

2.8 KiB
Raw Blame History

Public signed catalog

The v0.5.0 Forgejo release publishes the first immutable data generation that any Site Registry consumer can verify and resolve:

The release also carries a checksum file and an OpenSSH signature under namespace argand-site-registry-release. Verify it against trust/public-catalog-20260920/publisher-allowed-signers. The signed Git history is the independent channel for the trust root; do not learn the only trusted key from the archive it authenticates.

sha256sum --check argand-site-registry-catalog-20260920-v1.tar.gz.sha256
ssh-keygen -Y verify \
  -f trust/public-catalog-20260920/publisher-allowed-signers \
  -I argand-site-registry-publisher-v1 \
  -n argand-site-registry-release \
  -s argand-site-registry-catalog-20260920-v1.tar.gz.sig \
  < argand-site-registry-catalog-20260920-v1.tar.gz

After extraction, verify every member with SHA256SUMS, then authenticate the generation and exact reviewer trust root:

argand-site-registry activate \
  --generation public-release-v0.5.0/catalog \
  --current current.json \
  --allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
  --allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
  --identity argand-site-registry-publisher-v1

argand-site-registry resolve \
  --generation public-release-v0.5.0/catalog \
  --pin ede14746da8817aafdf705dd88cfeabbe8d23e1991e43a304acd8eca9249b18a \
  --query "yahoo mail"

Scope and trust

This first catalog is deliberately small. Its disclosed policy uses one automated evidence-gate reviewer group rather than claiming human-review quorum. Fresh exact endpoint observations are required, and source conflicts or dangerous drift need two groups, so the single automated reviewer must abstain on those risks. Sticky revocations and publisher/reviewer key separation remain enabled.

Consumers decide whether this policy is appropriate for their use. Preserve typed abstentions, retain attribution, and apply independent malware and content policy. Do not route to the first raw lookup result. High-risk or disputed catalogs should use the unchanged two-human-reviewer reference policy.

The generation's approvals expire. Installing an immutable archive is not a promise that every decision stays valid forever: use the resolver's requested time, consume cumulative signed revocation feeds when published, and move to a newly signed full generation before relying on renewed decisions.