Trust anchor
The verifier trusts Ed25519 public keys provisioned separately by an administrator or another authenticated channel. Key ID is the lowercase SHA-256 fingerprint of the public key's SPKI DER encoding. A manifest naming an unknown key ID is rejected.
Signed release metadata
The release private key signs canonical manifest bytes. The manifest binds filenames, artifact type, exact size, digest, release version, channel, timestamp, and key ID. HTTPS protects transport confidentiality/integrity in transit but is not the root of authenticity.
Key rotation and revocation
- Authenticate the new public key fingerprint through the independent trust channel.
- Add the new fingerprint-named key while the old key remains trusted.
- Publish and validate a release signed by the new key during the overlap.
- Remove the old key from trusted key stores to revoke it locally.
- For a compromised key, replace trust anchors out of band and review already installed artifacts.
A release cannot revoke the signing key used to sign that same release.
Rollback
Bootstrap stores a local high-water release record and serializes installs using a file lock. Corrupt state fails closed. State can still be changed by root or its owner; no hostile-root, fleet-wide, or transparency-log protection is implemented.
Bootstrap trust
Because the bootstrap is separate from the wheel, the wheel cannot execute code before its signature and bytes are verified. The bootstrap binary/script itself must also be obtained from a trusted source and reviewed; this repository does not yet provide an independently published, signed bootstrap distribution.