# Installer provenance Reviewed on 2026-08-27. `installers.conf` is data, not a shell fragment: the installer reads it only with `load_installer_provenance`. Its versions, URLs, SHA-256 values, byte limits, and complete primary fingerprints are reviewed inputs. No installer path may substitute a `latest` URL or execute fetched content before the applicable verification succeeds. ## Key retrieval and verification Each command below was run in a private temporary directory on 2026-08-27. The resulting armored public key is vendored under `keys/`; each output was checked with the listed complete primary fingerprint before it was committed. | Key | Source URL | Expected primary fingerprint | Verification command | | --- | --- | --- | --- | | Terra 44 | `https://repos.fyralabs.com/terra44/key.asc` | `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F` | `gpg --batch --with-colons --import-options show-only --import terra44.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | | Anthropic Claude Code | `https://downloads.claude.ai/keys/claude-code.asc` | `31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE` | `gpg --batch --with-colons --import-options show-only --import claude-code.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | | Bun releases | `https://keys.openpgp.org/vks/v1/by-fingerprint/F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `gpg --batch --with-colons --import-options show-only --import bun.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | | RPM Fusion free | `https://download1.rpmfusion.org/free/fedora/RPM-GPG-KEY-rpmfusion-free-fedora-2020` | `E9A491A3DE247814E7E067EAE06F8ECDD651FF2E` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-free.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | | RPM Fusion nonfree | `https://download1.rpmfusion.org/nonfree/fedora/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020` | `79BDB88F9BBF73910FD4095B6A2AF96194843C65` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-nonfree.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | | lionheartp/Hyprland COPR | `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg` | `97E23476C89635135407C7D5E9BA41342C4B2995` | `gpg --batch --with-colons --import-options show-only --import hyprland-copr.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | | Flathub | `https://flathub.org/repo/flathub.flatpakrepo` | `6E5C05D979C76DAF93C081354184DD4D907A7CAE` | `awk -F= '/^GPGKey=/{print $2}' flathub.flatpakrepo \| base64 --decode \| gpg --batch --with-colons --import-options show-only --import \| awk -F: '$1 == "fpr" { print $10; exit }'` | | Claude Desktop Extra | `https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc` | `825A7D15D78BABE45646D5DF382409F597908867` | `gpg --batch --with-colons --import-options show-only --import claude-desktop.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` | The retrieval command for every direct key was: ```bash curl --fail --location --connect-timeout 10 --max-time 60 --output KEY.asc SOURCE_URL ``` ## Reviewed publisher records and artifact locations The key sources above are supported by these publisher-controlled records: - `https://github.com/terrapkg/packages/blob/frawhide/README.md` - `https://github.com/terrapkg/packages/discussions/7736` - `https://code.claude.com/docs/en/setup` - `https://github.com/oven-sh/bun/releases/tag/bun-v1.4.0` - `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile` - `https://github.com/nodejs/node/releases/tag/v24.20.0` - `https://github.com/nodejs/node/blob/main/README.md` - `https://github.com/openai/codex/releases/tag/rust-v0.150.1` - `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml` - `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9` The reviewed immutable artifact and repository URLs are: - `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip` - `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip` - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz` - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz` - `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz` - `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz` - `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm` - `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm` - `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm` - `https://repos.fyralabs.com/terra44` - `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/fedora-$releasever-$basearch/` - `https://downloads.claude.ai/claude-code/rpm/stable` - `https://patrickjaja.github.io/claude-desktop-extra/rpm/` Artifact digests were checked with `sha256sum ARTIFACT` against the lowercase 64-hex values in `installers.conf`; all runtime downloads also enforce the recorded byte limit before atomic replacement. The `*_BINARY_SHA256` values are the SHA-256 digests of the exact executable bytes selected from each verified runtime archive. They were derived without executing the artifacts: `tar -xO` selected Node's `bin/node` and Codex's `bin/codex`, while `unzip -p` selected Bun's `bun`. Runtime version directories record both the reviewed archive digest and this reviewed installed-byte digest in `.panama-provenance`; later runs require the receipt and re-hash the installed binary before treating an existing directory as trusted. ## Panama bootstrap The public desktop and server commands use the same committed `boot` blob: ```text commit 0d1841cf86975d52485c94c0caa5d1b67e5c54a1 SHA-256 fd8dcd70d1266da109972df346e3d85d1037f6f6e1942b0157064412ab892372 URL https://git.gbrown.org/gib/Panama/raw/commit/0d1841cf86975d52485c94c0caa5d1b67e5c54a1/boot ``` The digest was derived from the committed blob with: ```bash git show 0d1841cf86975d52485c94c0caa5d1b67e5c54a1:boot | sha256sum ``` That implementation commit contains only `boot` and its boot/root-server contracts. The following documentation commit records the pin and does not contribute bytes to it. Rotate the bootstrap pin only through the same two-step sequence: commit the boot implementation first, derive its committed blob digest, then update the command and this ledger in a second commit. ## Rotation policy Do not replace a key on an automated update. A key rotation is a reviewed repository change: obtain the new key from the publisher record, independently confirm its complete primary fingerprint, update the vendored key and `installers.conf` together, refresh this retrieval record, and add a focused contract case if the verification behavior changes. Until that review lands, verification fails closed and preserves any known-good destination. ## Container-only Terra 44 signed-bootstrap proof On 2026-08-27, a single disposable rootless Podman container proved the Terra bootstrap path without changing the host package database, host keyring, or host repository files. Podman reported `rootless=true`, `runtime=crun`, and a user graph root. The fresh image was `registry.fedoraproject.org/fedora@sha256:62f199d1eb34170a7bb2277485676d89c0e91aae4086151c4043062cce51c77c` (`sha256:87d8a4a90c0457689db68624cac1026fb2201cbdc1e99cc5455a8f8876118498`). The container (`5fc8fa42bb85afb3b57b336ca29b58a32fad50d460583329a4e910cc29fb4d2d`) had no mounts and was removed automatically after `podman stop`. Before copying the only host file admitted to the container, `keys/terra44.asc`, this exact host check reported the complete primary fingerprint `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F`: ```bash gpg --batch --with-colons --import-options show-only --import setup/provenance/keys/terra44.asc \ | awk -F: '$1 == "fpr" { print $10; exit }' ``` Its SHA-256 was `3febbaadfa43509c22edc440d58c970705e502cdd0f347a75d5005562fd6b3d8`. The container commands were: ```bash podman create --name panama-terra-proof-20260827 --rm --pull=always \ registry.fedoraproject.org/fedora:44 sleep infinity podman cp setup/provenance/keys/terra44.asc \ panama-terra-proof-20260827:/tmp/terra44.asc podman start panama-terra-proof-20260827 podman exec panama-terra-proof-20260827 /bin/bash -lc ' sha256sum /tmp/terra44.asc install -Dm0644 /tmp/terra44.asc /etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 \ --setopt=terra.pkg_gpgcheck=1 \ --setopt=terra.repo_gpgcheck=1 \ --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \ terra-release ' ``` Inside the container the copied and installed key both had the recorded SHA-256 before and after installation. `terra-release-44-9.noarch` was installed. Its effective `terra` configuration reported `gpgcheck = 1`, `pkg_gpgcheck = 1`, and `repo_gpgcheck = 1`; no GPG-bypass option was used. The package's own `/etc/yum.repos.d/terra.repo` uses its Terra metalink and `RPM-GPG-KEY-terra44`. That differs from Panama's deliberately staged local key/base-URL file in `install-packages`, which replaces the release-generated file only after this verified bootstrap step. Although the command runner returned after 30 seconds while DNF was still loading metadata, Podman's retained event log records the exact command's completion. This read-only recovery command was run after container removal: ```bash podman events --since '2026-08-27T10:55:00-04:00' --until '2026-08-27T11:02:00-04:00' \ --filter container=5fc8fa42bb85afb3b57b336ca29b58a32fad50d460583329a4e910cc29fb4d2d \ --format json ``` The first `exec` event, at `timeNano=1787842633591543881`, is the documented key-install and DNF command. Its matching first `exec_died` event, at `timeNano=1787842671276003275`, records `ContainerExitCode:0`. The same-container post-check independently confirmed the installed package and effective signature settings above; no retry or second container was used.