Trustyu Forge
Public key
Fingerprint SHA-256 of the key in DER:5eda28f4351f324763d548acb28abce5616a85800457ba824fb7f027bffe9851
Sanitized public record · release 17 Jul 2026
Forge Incubator
0.8.0.
The tag and source SHA identify the cut. The inventory and digests live in the SHA256SUMS manifest, whose Ed25519 signature is verifiable; the signature does not cover the Git tag. Release integrity does not equate to operational qualification.
Public allowlist
Names, sizes
and digests.
Only metadata necessary for verification has been published. Code content, wheel, source distribution, detailed SBOM, compatibility map and full provenance remain private.
| Asset | Bytes | SHA-256 | Public body |
|---|---|---|---|
| compatibility-0.8.0.json | 1.762 | 6a775afe6e9abb312b976fbc34c71252d78638cbbd64f47a18e0492f33dbd39e | No |
| forge-release-signing-public.pem | 113 | 9b257db6e5a17d283678c82b8c29f8743ea1dd7b0cba7ea5fe50c5f4e2e31d25 | Yes |
| provenance.intoto.json | 1.553 | 8481e3dedf1becb309ab8485b8a1bdcbd140147cb59e8b93fb4c96d6b61ee4d4 | No |
| SHA256SUMS | 685 | f0775a1c0dfbd25323d98c24924d204d78dcf4c7b80f06a90380208c9748d350 | Yes |
| SHA256SUMS.sig | 64 | 9f13af67976267c45cdc78949ea900d930ce4feeab1891ab283a5b3f87115d29 | Base64 |
| SUBJECT_SHA256SUMS | 511 | dd5e520aba8c4aa63c3b6bd87a5bff518e8bfcd23b4a2ca2f2924c07fa544b30 | No |
| trustyu-forge-incubator-0.8.0.cdx.json | 4.077 | 926233632b0dff1e94b64dd5c19180ac9ad9289a9a0d10bf438724b37e2c7d78 | No |
| trustyu_forge_incubator-0.8.0-py3-none-any.whl | 118.072 | eded05cb8706162c9d94e2946b713af3409429ec6536584edae73b119aca7974 | No |
| trustyu_forge_incubator-0.8.0.tar.gz | 133.014 | 9c90d10491afe7e5a9891b768d3d19bec9bde2588acf9e3aeaeff83d8d8eb6c6 | No |
Local playback
Check signature
without trusting the page.
Download the four public files. The binary signature was published in Base64 to remain inspectable in Git; decode it and validate the manifest with OpenSSL.
# Linux openssl base64 -d -A -in SHA256SUMS.sig.b64 -out SHA256SUMS.sig # macOS: use base64 -D no lugar de --decode openssl pkeyutl -verify -pubin \ -inkey forge-release-signing-public.pem \ -rawin -in SHA256SUMS \ -sigfile SHA256SUMS.sig # resultado esperado Signature Verified Successfully
Test limit
Verification confirms that the published manifest was signed by the registered key. Because binaries remain private, anonymous visitors are unable to recompute package digests. The registry does not state level SLSA, external adoption, Operational or Attested.
Source: private release forge-v0.8.0 from the repository needyuai/trustyu-infra. Verification performed against the 9 original assets on Jul 17, 2026; publication limited by the issue's allowlist #13.