Packages & images

APT repository signed with a PGP key (managed automatically by the forge).

# 1) Repository signing key
curl -fsSL https://bit-crafts.com/keys/bitcrafts-debian.asc | sudo tee /etc/apt/keyrings/bitcrafts.asc >/dev/null

# 2) Add the repository
echo "deb [signed-by=/etc/apt/keyrings/bitcrafts.asc] https://code.bit-crafts.com/api/packages/bitcrafts/debian stable main" | sudo tee /etc/apt/sources.list.d/bitcrafts.list

# 3) Install
sudo apt update
sudo apt install <package>

Official NuGet feed. Packages are signed with a BitCrafts certificate (self-signed).

# Add the feed
dotnet nuget add source "https://code.bit-crafts.com/api/packages/bitcrafts/nuget/index.json" --name bitcrafts

# Install
dotnet add package --source bitcrafts --version 1.0.0 <Package>

# Verify a package signature
dotnet nuget verify <package>.nupkg

<trustedSigners>
  <author name="BitCrafts">
    <certificate fingerprint="55523B3DF38A063D0119D54C0B6440B25734E2F7F19BA332A1E3BFD8E0A9C82F" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
  </author>
</trustedSigners>

OCI images signed with cosign (Sigstore).

docker login code.bit-crafts.com

docker pull code.bit-crafts.com/bitcrafts/<image>:<tag>

cosign verify --key cosign.pub code.bit-crafts.com/bitcrafts/<image>:<tag>

Public keys to verify commits and signed artifacts.

gpg --import bitcrafts-gpg.asc     # author commit signatures
gpg --import gitea-signing.gpg     # forge-side signatures

git tag -v <tag>
gpg --verify <file>.asc <file>