Channel layout¶

The estate's channel is a GitLab generic package registry. This page documents what the package expects, so a mirror can reproduce it.

Base URL¶

https://gitlab.com/api/v4/projects/phpboyscout%2Fartifacts/packages/generic

Available as artifacts.DefaultChannel. It is a full API base rather than a host, because the registry path is part of the contract — a caller pointing at a mirror needs to reproduce the shape below it rather than guess it.

Override with artifacts.WithChannel(base). A trailing slash is trimmed.

Asset path¶

<base>/<artefact>/<version>/<file>

Each component is percent-escaped. <version> is the artefact's own upstream version — 1.28.0 for ONNX Runtime 1.28.0 — never a version of the channel, which does not have one.

Example:

.../packages/generic/onnxruntime/1.28.0/onnxruntime-linux-x64-1.28.0.tgz

The channel is public: these paths resolve without a token.

Files in every artefact-version¶

The channel also publishes the signing key as release.asc. This package never fetches it — trust comes from the key embedded in the calling binary and the key served over WKD. A key downloaded from the same place as the signature it validates proves nothing, which is why there is no constant for it.

Manifest format¶

The format sha256sum writes and reads:

<64 hex chars><whitespace><filename>

e15ff8b5d85afe6c144d97c6fd432254bf76a219daaf17658087d6ecb3e8f0bb  onnxruntime-linux-aarch64-1.28.0.tgz
a3e1b79d7bb1bf09696ce675f49e4064e6c81f6202b8225624fff0e93f8d6407  onnxruntime-linux-x64-1.28.0.tgz

Parsing is strict about the digest and relaxed about whitespace: exactly 64 lowercase hex characters, but any amount of space before the filename. A malformed digest is a corrupted or hostile manifest; an odd number of spaces is a text file having been through something.

Blank lines are skipped. Any other malformed line rejects the whole manifest with ErrMalformedManifest — a parser that skipped bad lines would silently accept a manifest with entries removed. A manifest listing no files is likewise rejected.

The manifest is authoritative for what a version contains. A file absent from it is ErrNotFound regardless of how the URL responds.

Signature format¶

A detached, ASCII-armored OpenPGP signature over the exact bytes of checksums.txt. This is what gtb's signing backend emits.

The signing key for the estate channel:

go/signing enforces a minimum key strength: Ed25519, or RSA at 3072 bits or above. It also requires the key returned by WKD to carry a UID matching the address requested — a key published under a different identity is a different key.

Verification order¶

1. checksums.txt and checksums.txt.sig are fetched.
2. The signature is verified against the trust anchors — before the manifest is parsed, because the parser is the first thing an attacker reaches.
3. The manifest is parsed.
4. The requested asset is fetched.
5. Its SHA-256 is compared against the manifest entry.
6. The verified bytes are written to the cache and the path returned.

A cache hit short-circuits at step 1.