Limedoc skins — store catalog

Signed coordinates for skin packs published to the Forgejo generic package registry org limedoc-skins. This repo does not hold pack source trees or zip payloads.

Files

File	Purpose
catalog.json	Pack listings (kind, id, version, download/sha256/sig URLs)
catalog.json.sig.json	OpenBao signature over the canonical catalog hash (CI)
scripts/canonical_hash.ts	Offline hash helper (sorted-key JSON + trailing LF)

Raw URLs

https://git.belowtoxic.cloud/belowtoxic.eu/limedoc-skins/raw/branch/main/catalog.json
https://git.belowtoxic.cloud/belowtoxic.eu/limedoc-skins/raw/branch/main/catalog.json.sig.json

Limedoc today browses via PACKAGE_STORE_URL/v1/packs (store front-end). This catalog is the signed source of truth those fronts (or a future client fallback) should mirror.

Package bytes (Forgejo generic packages)

Piece	URL pattern
Zip	…/api/packages/limedoc-skins/generic/{id}/{version}/{id}-{version}.zip
Content hash	…/{id}-{version}.sha256
Pack signature	…/{id}-{version}.sig.json

Pack source repos live under org limedoc-skins/<id> and publish with Transit key publisher-limedoc-skins-release.

OpenBao (this catalog repo)

Item	Value
JWT role	limedoc-registry-skins
Bound repo	belowtoxic.eu/limedoc-skins (refs/heads/main)
Transit key / keyId	limedoc-registry-skins-2026

Limedoc verifies catalog signatures with storeCatalogKeys in the app’s baked release-trust.json (not the trust-root key used for publishers.json).

Add a pack row

1. Publish zip + sha256 + sig.json from the pack’s publisher CI.
2. Append/update an entry in catalog.json.
3. Merge to main — CI resigns and commits catalog.json.sig.json.

CI secret

PACKAGE_TOKEN — Forgejo token with write access to this repo.

Local hash

deno run -A scripts/canonical_hash.ts catalog.json