/verify/

Verify

Source

Published copies are on src.thepeoples.io. Open a project and read the tree. Clone with:

git clone https://src.thepeoples.io/thepeoples-io/.git

A catalog note on this site, if one exists, is only a summary. The files are the record.

A release

A release is a tagged bundle on Source: source tarball, checksums, and an SBOM, bound to one commit. The list is on that project's /releases/ path under src.thepeoples.io. If a project has not published one, that page says so. When a scan report exists next to the bundle, the release page shows it.

When a bundle exists:

1. Download the artifact from the release page.
2. Hash the file on disk (sha256sum).
3. Compare that digest to the published .sha256 sidecar next to the artifact.

A Flatpak

Install steps and per-app pins are on Flatpak. Catalog CI scans the pinned vendor RPM, DEB, or tarball after extract (no install scripts) and before wrap. Each app page shows wrap-layer findings (gate) versus vendor findings (informational). If Trivy cannot name packages in the extract, the page says not inventoried — that is not a clean result.

To check the remote:

• Remote: flatpak.thepeoples.io/thepeoples.flatpakrepo
• Signing key: /keys/io.thepeoples.gpg, fingerprint 98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841
• Each app page lists the vendor pin and any helper hash

This catalog

What this catalog contains lists the published projects, source copies, and releases behind these pages. It is rewritten when the catalog is rebuilt.