Limedoc trust registry

Vetted publisher public keys for Limedoc pack verification. The app syncs this file (lazy, max age 24h) and verifies it with the trust-root key baked into release-trust.json.

Files

File	Purpose
publishers.json	Publisher ids, tiers (core | partner), Ed25519 public keys
publishers.json.sig.json	OpenBao Transit signature over the canonical hash (written by CI)
scripts/canonical_hash.ts	Offline hash helper (sorted-key JSON + trailing LF)

Raw URLs (baked into Limedoc images)

https://git.belowtoxic.cloud/belowtoxic.eu/limedoc-trust/raw/branch/main/publishers.json
https://git.belowtoxic.cloud/belowtoxic.eu/limedoc-trust/raw/branch/main/publishers.json.sig.json

OpenBao

Item	Value
JWT role	limedoc-registry-trust
Bound repo	belowtoxic.eu/limedoc-trust (ref refs/heads/main)
Transit key / keyId	limedoc-registry-trust-2026
Sign input	UTF-8 bytes of the 64-char lowercase hex hash

Sign encoding matches Limedoc lib/trust/signature.ts (strip vault:vN: prefix from Transit output before writing signature).

CI

On push to main (or manual Run workflow on main), .forgejo/workflows/publish.yml:

1. Lint publishers.json (schema + fingerprint check via limedoc-dev when available)
2. Hash via /limedoc/scripts/trust_hash_registry.ts (schema-normalized; matches app verify)
3. JWT login → Transit sign
4. Commit/push publishers.json.sig.json so the raw URL stays current

Secret: PACKAGE_TOKEN — Forgejo token with write access to this repo (same convention as pack publish workflows).

PRs only lint; they do not sign or commit. Manual runs on main sign and commit like a push.

Rotation

1. Add the new public key to publishers.json (keep the old key during grace).
2. Merge to main so CI resigns.
3. After grace, remove the old key and merge again.

See Limedoc docs/security/TRUST_ROLES_AND_ROTATION.md and docs/security/OPENBAO_SIGNING.md.

Local hash

Authoritative hash (matches app verify) requires the Limedoc tree / limedoc-dev image:

deno eval '
  import { assertPublishersRegistry } from "/limedoc/lib/trust/registry_schema.ts"
  import { hashRegistry } from "/limedoc/lib/trust/registry.ts"
  const r = assertPublishersRegistry(JSON.parse(await Deno.readTextFile("publishers.json")))
  console.log(await hashRegistry(r))
'

scripts/canonical_hash.ts hashes the raw file as-is (useful for catalogs / sanity). It can differ from hashRegistry after schema normalization — CI signs the normalized hash.