stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 12 Releases Wiki Activity
Files
bb709b643eb55ab80551a51c79f70a6e6286c32c
git.stella-ops.org/scripts/mirror/README.md
StellaOps Bot cce96f3596
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
blockers 2
2025-11-23 14:54:17 +02:00

665 B
Raw Blame History

Mirror signing helpers

  • make-thin-v1.sh: builds thin bundle v1, computes checksums, optional DSSE+TUF signing when SIGN_KEY is set, and runs verifier.
  • sign_thin_bundle.py: signs manifest (DSSE) and root/targets/snapshot/timestamp JSON using an Ed25519 PEM key.
  • verify_thin_bundle.py: checks SHA256 sidecars, manifest schema, tar determinism, and manifest/index digests.
  • ci-sign.sh: CI wrapper. Set MIRROR_SIGN_KEY_B64 (base64-encoded Ed25519 PEM) and run; it builds, signs, and verifies in one step.
  • verify_oci_layout.py: validates OCI layout/index/manifest and blob digests when OCI=1 is used.

Artifacts live under out/mirror/thin/.