6.0 KiB
Installer provenance
Reviewed on 2026-08-27. installers.conf is data, not a shell fragment: the
installer reads it only with load_installer_provenance. Its versions, URLs,
SHA-256 values, byte limits, and complete primary fingerprints are reviewed
inputs. No installer path may substitute a latest URL or execute fetched
content before the applicable verification succeeds.
Key retrieval and verification
Each command below was run in a private temporary directory on 2026-08-27.
The resulting armored public key is vendored under keys/; each output was
checked with the listed complete primary fingerprint before it was committed.
| Key | Source URL | Expected primary fingerprint | Verification command |
|---|---|---|---|
| Terra 44 | https://repos.fyralabs.com/terra44/key.asc |
AE09157A4DE88B497EA1D5D300CDAB43DE226D6F |
gpg --batch --with-colons --import-options show-only --import terra44.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
| Anthropic Claude Code | https://downloads.claude.ai/keys/claude-code.asc |
31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE |
gpg --batch --with-colons --import-options show-only --import claude-code.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
| Bun releases | https://keys.openpgp.org/vks/v1/by-fingerprint/F3DCC08A8572C0749B3E18888EAB4D40A7B22B59 |
F3DCC08A8572C0749B3E18888EAB4D40A7B22B59 |
gpg --batch --with-colons --import-options show-only --import bun.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
| RPM Fusion free | https://download1.rpmfusion.org/free/fedora/RPM-GPG-KEY-rpmfusion-free-fedora-2020 |
E9A491A3DE247814E7E067EAE06F8ECDD651FF2E |
gpg --batch --with-colons --import-options show-only --import rpmfusion-free.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
| RPM Fusion nonfree | https://download1.rpmfusion.org/nonfree/fedora/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020 |
79BDB88F9BBF73910FD4095B6A2AF96194843C65 |
gpg --batch --with-colons --import-options show-only --import rpmfusion-nonfree.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
| lionheartp/Hyprland COPR | https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg |
97E23476C89635135407C7D5E9BA41342C4B2995 |
gpg --batch --with-colons --import-options show-only --import hyprland-copr.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
| Flathub | https://flathub.org/repo/flathub.flatpakrepo |
6E5C05D979C76DAF93C081354184DD4D907A7CAE |
awk -F= '/^GPGKey=/{print $2}' flathub.flatpakrepo | base64 --decode | gpg --batch --with-colons --import-options show-only --import | awk -F: '$1 == "fpr" { print $10; exit }' |
| Claude Desktop Extra | https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc |
825A7D15D78BABE45646D5DF382409F597908867 |
gpg --batch --with-colons --import-options show-only --import claude-desktop.asc | awk -F: '$1 == "fpr" { print $10; exit }' |
The retrieval command for every direct key was:
curl --fail --location --connect-timeout 10 --max-time 60 --output KEY.asc SOURCE_URL
Reviewed publisher records and artifact locations
The key sources above are supported by these publisher-controlled records:
https://github.com/terrapkg/packages/blob/frawhide/README.mdhttps://github.com/terrapkg/packages/discussions/7736https://code.claude.com/docs/en/setuphttps://github.com/oven-sh/bun/releases/tag/bun-v1.4.0https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfilehttps://github.com/nodejs/node/releases/tag/v24.20.0https://github.com/nodejs/node/blob/main/README.mdhttps://github.com/openai/codex/releases/tag/rust-v0.150.1https://github.com/openai/codex/blob/main/.github/workflows/rust-release.ymlhttps://github.com/rustdesk/rustdesk/releases/tag/1.4.9
The reviewed immutable artifact and repository URLs are:
https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.ziphttps://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.ziphttps://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xzhttps://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xzhttps://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gzhttps://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gzhttps://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpmhttps://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpmhttps://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpmhttps://repos.fyralabs.com/terra44https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/fedora-$releasever-$basearch/https://downloads.claude.ai/claude-code/rpm/stablehttps://patrickjaja.github.io/claude-desktop-extra/rpm/
Artifact digests were checked with sha256sum ARTIFACT against the lowercase
64-hex values in installers.conf; all runtime downloads also enforce the
recorded byte limit before atomic replacement.
The *_BINARY_SHA256 values are the SHA-256 digests of the exact executable
bytes selected from each verified runtime archive. They were derived without
executing the artifacts: tar -xO selected Node's bin/node and Codex's
bin/codex, while unzip -p selected Bun's bun. Runtime version directories
record both the reviewed archive digest and this reviewed installed-byte digest
in .panama-provenance; later runs require the receipt and re-hash the installed
binary before treating an existing directory as trusted.
Rotation policy
Do not replace a key on an automated update. A key rotation is a reviewed
repository change: obtain the new key from the publisher record, independently
confirm its complete primary fingerprint, update the vendored key and
installers.conf together, refresh this retrieval record, and add a focused
contract case if the verification behavior changes. Until that review lands,
verification fails closed and preserves any known-good destination.