thepeoples
Cosign, ostree, SSH

Verify

Check a Flatpak, an OCI image, a release bundle, or an SSH host key against the files this catalog publishes. Signatures say who published the bytes; read the artifact too.

Check a signature, SBOM, or host key before you run the bytes.

Choose the kind of artifact.

Source

Trees on Source. Published copies are on src.thepeoples.io. A catalog note on this site, if one exists, is only a summary. The files are the record.

A release

A release is a tagged bundle on Source: source tarball, checksums, and an SBOM, bound to one commit. Quarry’s tagged bundles live under Quarry releases. If a project has not published one, that page says so. When a scan report exists next to the bundle, the release page shows it.

When a bundle exists:

  1. Download the artifact from the release page.
  2. Hash the file on disk (sha256sum).
  3. Compare that digest to the published .sha256 sidecar next to the artifact.

A Flatpak

Install steps and per-app pins are on Flatpak. Catalog CI scans the pinned vendor RPM, DEB, or tarball after extract (no install scripts) and before wrap. Each app page shows wrap-layer findings (gate) versus vendor findings (informational). If Trivy cannot name packages in the extract, the page says not inventoried — that is not a clean result.

flatpak --user remote-ls thepeoples
# ostree key fingerprint
98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841

Remote: flatpak.thepeoples.io/thepeoples.flatpakrepo. Signing key: /keys/io.thepeoples.gpg.

An OCI image

Public pull URL: oci.thepeoples.io. Every public tag is cosign-signed (thepeoples.io redistribution, not vendor-official). Unsigned images are not promoted. --insecure-ignore-tlog is the keyful v1 path — public key on this site, no Rekor. Pin the digest after verify, before you apply.

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/argocd@sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8

SSH

Operator public keys and the script that installs them are on SSH. A default install writes the dev-agent-01 and workstation keys. The optional name is --with laptop.

This catalog

Pages are static files. Source of the publisher is thepeoples-io. Provenance lists the published projects, source copies, and releases behind these pages.