nicweyand
62e7a67cba
Some checks failed
Standalone registry checks / check (push) Has been cancelled
82 lines
3.8 KiB
Markdown
82 lines
3.8 KiB
Markdown
# Public signed catalog
|
|
|
|
The v0.6.2 Forgejo release publishes the current immutable data generation that
|
|
Argand and any other Site Registry consumer can verify and resolve:
|
|
|
|
- release: <https://git.argand.org/nicweyand/argand-site-registry/releases/tag/v0.6.2>
|
|
- asset: `argand-site-registry-catalog-v0.6.2.tar.gz`
|
|
- asset SHA-256:
|
|
`48b0cdf453862d858c4bec6c564360e1309605e30af9aba1f54a9446b9bdbe41`
|
|
- generation pin:
|
|
`5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309`
|
|
|
|
The release also carries a checksum file and an OpenSSH signature under namespace
|
|
`argand-site-registry-release`. Verify it against
|
|
[`trust/public-catalog-20260920/publisher-allowed-signers`](../trust/public-catalog-20260920/publisher-allowed-signers).
|
|
The signed Git history is the independent channel for the trust root; do not learn
|
|
the only trusted key from the archive it authenticates.
|
|
|
|
```bash
|
|
sha256sum --check argand-site-registry-catalog-v0.6.2.tar.gz.sha256
|
|
ssh-keygen -Y verify \
|
|
-f trust/public-catalog-20260920/publisher-allowed-signers \
|
|
-I argand-site-registry-publisher-v1 \
|
|
-n argand-site-registry-release \
|
|
-s argand-site-registry-catalog-v0.6.2.tar.gz.sig \
|
|
< argand-site-registry-catalog-v0.6.2.tar.gz
|
|
```
|
|
|
|
After extraction, verify every member with `SHA256SUMS`, then authenticate the
|
|
generation and exact reviewer trust root:
|
|
|
|
```bash
|
|
argand-site-registry activate \
|
|
--generation public-release-v0.6.2/catalog \
|
|
--current current.json \
|
|
--allowed-signers trust/public-catalog-20260920/publisher-allowed-signers \
|
|
--allowed-reviewers trust/public-catalog-20260920/reviewer-allowed-signers \
|
|
--identity argand-site-registry-publisher-v1
|
|
|
|
argand-site-registry resolve \
|
|
--generation public-release-v0.6.2/catalog \
|
|
--pin 5e5d8fd5dc1864dc3f4c53ec71cb5ac64f6db592cfbc8cc56f48a444378e2309 \
|
|
--query "facebook"
|
|
```
|
|
|
|
## Scope and trust
|
|
|
|
The v0.6.2 catalog contains 976 entities, 1,062 official-site edges, 20,178
|
|
multilingual name facts, and Common Crawl Web Graph evidence for 840 domains that
|
|
already had imported identity assertions. Graph authority can prioritize review
|
|
and disambiguation, but cannot create an identity, official-site assertion,
|
|
review, vote, or redirect. The archive includes all 33 authenticated cold audit
|
|
objects referenced by the compact runtime generation.
|
|
|
|
The bounded Wikidata discovery input is broad but not a representative or
|
|
high-demand sample. Its query and selection metadata are included for audit; raw
|
|
discovery output is never approval.
|
|
|
|
The disclosed policy uses one automated evidence-gate reviewer group rather than
|
|
claiming human-review quorum. Fresh exact endpoint observations are required, and
|
|
source conflicts or dangerous drift need two groups, so the single automated
|
|
reviewer must abstain on those risks. Sticky revocations and
|
|
publisher/reviewer-key separation remain enabled.
|
|
|
|
Consumers decide whether this policy is appropriate for their use. Preserve typed
|
|
abstentions, retain attribution, and apply independent malware and content policy.
|
|
Do not route to the first raw lookup result. High-risk or disputed catalogs should
|
|
use the unchanged two-human-reviewer reference policy.
|
|
|
|
The generation's approvals expire. Installing an immutable archive is not a promise
|
|
that every decision stays valid forever: use the resolver's requested time,
|
|
consume cumulative signed revocation feeds when published, and move to a newly
|
|
signed full generation before relying on renewed decisions.
|
|
|
|
## Regular updates
|
|
|
|
The public source repository includes the same updater used to refresh candidate
|
|
generations. The example systemd timer runs weekly. It can download, authenticate,
|
|
import and build, but it holds no publisher key and cannot approve, sign or
|
|
activate a candidate. That separation lets any consumer automate evidence updates
|
|
without allowing a compromised downloader or changed upstream dataset to silently
|
|
change redirects.
|