105 lines
6.8 KiB
Markdown
105 lines
6.8 KiB
Markdown
# Installer provenance
|
|
|
|
Reviewed on 2026-08-27. `installers.conf` is data, not a shell fragment: the
|
|
installer reads it only with `load_installer_provenance`. Its versions, URLs,
|
|
SHA-256 values, byte limits, and complete primary fingerprints are reviewed
|
|
inputs. No installer path may substitute a `latest` URL or execute fetched
|
|
content before the applicable verification succeeds.
|
|
|
|
## Key retrieval and verification
|
|
|
|
Each command below was run in a private temporary directory on 2026-08-27.
|
|
The resulting armored public key is vendored under `keys/`; each output was
|
|
checked with the listed complete primary fingerprint before it was committed.
|
|
|
|
| Key | Source URL | Expected primary fingerprint | Verification command |
|
|
| --- | --- | --- | --- |
|
|
| Terra 44 | `https://repos.fyralabs.com/terra44/key.asc` | `AE09157A4DE88B497EA1D5D300CDAB43DE226D6F` | `gpg --batch --with-colons --import-options show-only --import terra44.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| Anthropic Claude Code | `https://downloads.claude.ai/keys/claude-code.asc` | `31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE` | `gpg --batch --with-colons --import-options show-only --import claude-code.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| Bun releases | `https://keys.openpgp.org/vks/v1/by-fingerprint/F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `F3DCC08A8572C0749B3E18888EAB4D40A7B22B59` | `gpg --batch --with-colons --import-options show-only --import bun.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| RPM Fusion free | `https://download1.rpmfusion.org/free/fedora/RPM-GPG-KEY-rpmfusion-free-fedora-2020` | `E9A491A3DE247814E7E067EAE06F8ECDD651FF2E` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-free.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| RPM Fusion nonfree | `https://download1.rpmfusion.org/nonfree/fedora/RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020` | `79BDB88F9BBF73910FD4095B6A2AF96194843C65` | `gpg --batch --with-colons --import-options show-only --import rpmfusion-nonfree.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| lionheartp/Hyprland COPR | `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/pubkey.gpg` | `97E23476C89635135407C7D5E9BA41342C4B2995` | `gpg --batch --with-colons --import-options show-only --import hyprland-copr.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| Flathub | `https://flathub.org/repo/flathub.flatpakrepo` | `6E5C05D979C76DAF93C081354184DD4D907A7CAE` | `awk -F= '/^GPGKey=/{print $2}' flathub.flatpakrepo \| base64 --decode \| gpg --batch --with-colons --import-options show-only --import \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
| Claude Desktop Extra | `https://patrickjaja.github.io/claude-desktop-extra/gpg-key.asc` | `825A7D15D78BABE45646D5DF382409F597908867` | `gpg --batch --with-colons --import-options show-only --import claude-desktop.asc \| awk -F: '$1 == "fpr" { print $10; exit }'` |
|
|
|
|
The retrieval command for every direct key was:
|
|
|
|
```bash
|
|
curl --fail --location --connect-timeout 10 --max-time 60 --output KEY.asc SOURCE_URL
|
|
```
|
|
|
|
## Reviewed publisher records and artifact locations
|
|
|
|
The key sources above are supported by these publisher-controlled records:
|
|
|
|
- `https://github.com/terrapkg/packages/blob/frawhide/README.md`
|
|
- `https://github.com/terrapkg/packages/discussions/7736`
|
|
- `https://code.claude.com/docs/en/setup`
|
|
- `https://github.com/oven-sh/bun/releases/tag/bun-v1.4.0`
|
|
- `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
|
|
- `https://github.com/nodejs/node/releases/tag/v24.20.0`
|
|
- `https://github.com/nodejs/node/blob/main/README.md`
|
|
- `https://github.com/openai/codex/releases/tag/rust-v0.150.1`
|
|
- `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
|
|
- `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
|
|
|
|
The reviewed immutable artifact and repository URLs are:
|
|
|
|
- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip`
|
|
- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
|
|
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
|
|
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
|
|
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz`
|
|
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz`
|
|
- `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
|
|
- `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
|
|
- `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
|
|
- `https://repos.fyralabs.com/terra44`
|
|
- `https://download.copr.fedorainfracloud.org/results/lionheartp/Hyprland/fedora-$releasever-$basearch/`
|
|
- `https://downloads.claude.ai/claude-code/rpm/stable`
|
|
- `https://patrickjaja.github.io/claude-desktop-extra/rpm/`
|
|
|
|
Artifact digests were checked with `sha256sum ARTIFACT` against the lowercase
|
|
64-hex values in `installers.conf`; all runtime downloads also enforce the
|
|
recorded byte limit before atomic replacement.
|
|
|
|
The `*_BINARY_SHA256` values are the SHA-256 digests of the exact executable
|
|
bytes selected from each verified runtime archive. They were derived without
|
|
executing the artifacts: `tar -xO` selected Node's `bin/node` and Codex's
|
|
`bin/codex`, while `unzip -p` selected Bun's `bun`. Runtime version directories
|
|
record both the reviewed archive digest and this reviewed installed-byte digest
|
|
in `.panama-provenance`; later runs require the receipt and re-hash the installed
|
|
binary before treating an existing directory as trusted.
|
|
|
|
## Panama bootstrap
|
|
|
|
The public desktop and server commands use the same committed `boot` blob:
|
|
|
|
```text
|
|
commit 0d1841cf86975d52485c94c0caa5d1b67e5c54a1
|
|
SHA-256 fd8dcd70d1266da109972df346e3d85d1037f6f6e1942b0157064412ab892372
|
|
URL https://git.gbrown.org/gib/Panama/raw/commit/0d1841cf86975d52485c94c0caa5d1b67e5c54a1/boot
|
|
```
|
|
|
|
The digest was derived from the committed blob with:
|
|
|
|
```bash
|
|
git show 0d1841cf86975d52485c94c0caa5d1b67e5c54a1:boot | sha256sum
|
|
```
|
|
|
|
That implementation commit contains only `boot` and its boot/root-server
|
|
contracts. The following documentation commit records the pin and does not
|
|
contribute bytes to it. Rotate the bootstrap pin only through the same two-step
|
|
sequence: commit the boot implementation first, derive its committed blob
|
|
digest, then update the command and this ledger in a second commit.
|
|
|
|
## Rotation policy
|
|
|
|
Do not replace a key on an automated update. A key rotation is a reviewed
|
|
repository change: obtain the new key from the publisher record, independently
|
|
confirm its complete primary fingerprint, update the vendored key and
|
|
`installers.conf` together, refresh this retrieval record, and add a focused
|
|
contract case if the verification behavior changes. Until that review lands,
|
|
verification fails closed and preserves any known-good destination.
|