Highlights
- Known signers can add their signature to a package version already in the index with
start-cli registry package sign.
Full changelog
[1.4.0]
Added
-
Known signers can add their signature to a package version already in the index with
start-cli registry package sign. -
Accept verified package endorsements submitted by the CLI when adding packages, mirrors, and promoted packages, including when hosted files contain only the base archive. Signer registration and publishing authorization remain unchanged.
-
Reject submitted endorsements that do not match the indexed package's exact commitment.
Fixed
-
Re-adding an already indexed package with a different key now adds that key's signature instead of discarding it.
-
Registry trust proposals reference selected signer IDs and retain their complete GPG public-key information.
start-registry packages Checksums
SHA-256
059866df05f69f1a903659284c140d6f07ae15bc71f5f811aaa896d0c1985ec2 start-registry_1.4.0_amd64.deb
8b66e039f1167afd44e5b0e2f28d7ebdd598cee60cf2572e64095c96588c8370 start-registry_1.4.0_arm64.deb
2bbea32c5c1c268ac94a71c091876cb05c5c9d9cb84db21d77f8b9d924793b06 start-registry_1.4.0_riscv64.deb
BLAKE-3
38ab658bfff3c165d6cc5ba376204ec42cb185459066567b34bbdef59425dcd3 start-registry_1.4.0_amd64.deb
1ea2f0ef4554431998786d82108c9110e8d0271c4f8fac36229816fc08f4ac46 start-registry_1.4.0_arm64.deb
7577ec0b15cdc97362459830533e046ff6c77bf26fa391028471a1574c45f641 start-registry_1.4.0_riscv64.deb