@homeflare/alchemy 0.21.0 → 0.23.0

package/src/proxmox/zfs-pool.ts

@@ -6,20 +6,22 @@
  *   moment the worker runs. Every other decision in this file follows from that one sentence, and
  *   each of them is written out below rather than left to be inferred.
  *
- * ⛔ DESTROY IS REFUSED. `delete` MAKES NO API CALL — removing this resource from a stack leaves
- *   the zpool and its data exactly where they are, and Alchemy simply forgets about them. The
- *   asymmetry is the whole argument: an ORPHANED pool is recoverable (declare it again, or destroy
- *   it by hand once a human has looked at which disks are in it), a DESTROYED pool is not. Alchemy
- *   deletes for reasons that have nothing to do with anybody intending it — a line removed from a
- *   stack file, a resource renamed so the old id is dropped, a whole stack torn down by the wrong
- *   command, a replace triggered by a prop nobody meant to touch. Handing `zpool destroy` to any
- *   of those is not a feature. MEASURED in the node's own source: the DELETE handler forks
- *   `zfsremove`, which runs `zpool destroy <name>` unconditionally, and with `cleanup-disks` then
- *   calls `wipe_blockdev` on every member. Neither flag is offered as a prop, because there is no
- *   call here for them to reach.
- *   ★ THE OPERATOR'S PATH IS `pvesh delete /nodes/<node>/disks/zfs/<name>`, typed by a person who
- *     has just looked at the pool. Do not "complete the CRUD" by wiring `delete` to `ops.destroy`:
- *     that one line turns a text edit into an unrecoverable one.
+ * ⛔ ★ CORRECTED 2026-09-23 — THIS PARAGRAPH PREVIOUSLY SAID "DESTROY IS REFUSED" AND "`delete`
+ *   MAKES NO API CALL". THAT WAS FALSE: MEASURED against this file's own `handlers.delete` below,
+ *   which calls `destroyPool`, which sends `DELETE /nodes/{node}/disks/zfs/{name}` — the node's
+ *   own source forks `zfsremove`, which runs `zpool destroy <name>` unconditionally, and with
+ *   `cleanup-disks` then calls `wipe_blockdev` on every member (neither flag is offered as a prop,
+ *   because there is no call here for them to reach). `delete` is FULLY IMPLEMENTED, per S14
+ *   (alchemy-provider-standard): a `delete` that silently does nothing lies to whoever reads the
+ *   plan. What actually keeps an ordinary removed declaration from reaching it is
+ *   `defaultRemovalPolicy: 'retain'` below — Alchemy SKIPS `provider.delete` entirely for an
+ *   orphaned or destroyed resource under `retain`, so the state row drops and the zpool and its
+ *   data are left exactly where they are. The asymmetry is still the whole argument: an ORPHANED
+ *   pool is recoverable (declare it again, or destroy it by hand once a human has looked at which
+ *   disks are in it), a DESTROYED pool is not — which is why `retain` is the default rather than a
+ *   documented caution, and why `delete` runs only for a caller who opts in by name with
+ *   `.pipe(RemovalPolicy.destroy())`. See the ★ on `defaultRemovalPolicy` in resource-spec.ts, and
+ *   zfs-pool-adopt.test.ts's mutation row, which pins exactly one DELETE reaching the fake cluster.
  *
  * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema
  *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on node-b 2026-09-13): `/nodes/{node}/disks/zfs`
@@ -47,7 +49,8 @@
  * ⚠️ TWO HANDLERS ARE OVERRIDDEN AND THE OTHER THREE COME FROM THE FACTORY — see the ★ above
  *   `handlers`. `delete` is the ⛔ above. `reconcile` is because the create is a FORKED WORKER, so
  *   the factory's immediate read-back would report a successful create as a failure; the measured
- *   detail is in the ⛔ on `createPool` in zfs-pool-create.ts.
+ *   detail, and the adopt-only refusal decision 9 adds, are both in `createPool` in
+ *   zfs-pool-write.ts.
  *
  * ⚠️ PRIVILEGES, FROM THE SCHEMA. Read and diff need `Sys.Audit` on `/` — both GETs check it.
  *   Reconcile needs `Sys.Modify` on `/` for the POST. `Datastore.Allocate` on `/storage` is NOT
@@ -57,29 +60,23 @@
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import {
-  type PveRequirements,
-  type PveSpec,
-  type WithTarget,
-  pveHandlers,
-  pveOperations,
-} from './resource.ts';
-import { text } from './values.ts';
-import { ZFS_POOL_ENDPOINT, createForm, createPool, destroyPool } from './zfs-pool-write.ts';
+import type { NodesNodeDisksZfsPostParams } from './generated/pve.ts';
+import { type PveRequirements, type WithTarget, pveHandlers, pveOperations } from './resource.ts';
+import { spec } from './zfs-pool-spec.ts';
+import { createPool, destroyPool } from './zfs-pool-write.ts';
 
-/** PVE's layouts. ⚠️ Each has a minimum disk count PVE enforces, and `raid10` needs an even one. */
-export type ZfsRaidLevel =
-  | 'single'
-  | 'mirror'
-  | 'raid10'
-  | 'raidz'
-  | 'raidz2'
-  | 'raidz3'
-  | 'draid'
-  | 'draid2'
-  | 'draid3';
+/**
+ * PVE's layouts, generated (2026-09-23) from `NodesNodeDisksZfsPostParams['raidlevel']`
+ * (`generated/pve.ts`, manifest `pve-apidoc` pve-manager 9.2.11 sha256 9def8f13…) rather than
+ * hand-typed, per decision 9. ⚠️ Each has a minimum disk count PVE enforces, and `raid10` needs an
+ * even one. ⛔ THERE IS NO `stripe` IN THIS ENUM. n1's `speed` pool is one (decision 14 accepts it
+ * as-is): `ZfsPoolProps` below is why a stripe pool is declarable at all — as an ADOPT-ONLY
+ * declaration with no `raidlevel`, never as a full one.
+ */
+export type ZfsRaidLevel = NonNullable<NodesNodeDisksZfsPostParams['raidlevel']>;
 
-export type ZfsCompression = 'on' | 'off' | 'gzip' | 'lz4' | 'lzjb' | 'zle' | 'zstd';
+/** Generated the same way, from `NodesNodeDisksZfsPostParams['compression']`. */
+export type ZfsCompression = NonNullable<NodesNodeDisksZfsPostParams['compression']>;
 
 /**
  * ⛔ THERE IS NO `add_storage`, `cleanup-config` OR `cleanup-disks` PROP, AND THAT IS NOT AN
@@ -112,9 +109,19 @@ export interface ZfsPoolProps extends WithTarget {
    *   `csv` sorts, and sorting this list silently re-pairs the mirrors into a different pool.
    * ⚠️ PVE's only guard is `assert_disk_unused`, i.e. its own `disk_is_used` over the same `used`
    *   column the Disks view shows. A blank disk it considers free is wiped with no confirmation.
+   *
+   * ⛔ OPTIONAL SINCE DECISION 9 (2026-09-23), AND OMITTING IT MEANS SOMETHING SPECIFIC: leaving
+   *   both this and `raidlevel` undeclared declares an ADOPT-ONLY pool — one this resource may
+   *   read and report but never build. That is the only shape available for a pool PVE's own POST
+   *   schema cannot fully describe, such as n1's `speed`, whose layout is a stripe and whose
+   *   `raidlevel` enum (above) has no stripe to declare. `createForm` (zfs-pool-write.ts) omits
+   *   both keys when they are absent, and `createPool` refuses before any POST if the pool it
+   *   would need to build is not already there — an adopt-only declaration never creates. Declare
+   *   both fields together for a pool this resource should build from scratch; declaring only one
+   *   of the two is refused the same way, since PVE's POST requires both.
    */
-  devices: readonly string[];
-  raidlevel: ZfsRaidLevel;
+  devices?: readonly string[];
+  raidlevel?: ZfsRaidLevel;
   /**
    * Sector size exponent, 9–16, PVE default 12.
    *
@@ -174,63 +181,6 @@ export const ProxmoxZfsPool = Resource<ProxmoxZfsPool>('Proxmox.ZfsPool', {
   defaultRemovalPolicy: 'retain',
 });
 
-/**
- * The device paths at the bottom of PVE's vdev tree, in the order ZFS reports them.
- *
- * ⚠️ "NO CHILDREN" IS THE LEAF TEST, AND IT IS NOT A GUESS — MEASURED in the node's `preparetree`,
- *   which sets `leaf` to 0 when there are children and 1 otherwise. Reading the flag would work
- *   equally well; recursing on `children` needs no second field to be present and is what makes
- *   nested sections (mirrors inside a raid10, `spares`, `cache`) flatten correctly.
- */
-const leafDevices = (children: unknown): string[] =>
-  Array.isArray(children)
-    ? children.flatMap((entry: unknown) => {
-        const vdev = entry as { children?: unknown; name?: unknown };
-        const nested = leafDevices(vdev.children);
-        return nested.length > 0 ? nested : [text(vdev.name)].filter((name) => name !== '');
-      })
-    : [];
-
-const spec: PveSpec<ZfsPoolProps, ZfsPoolAttributes> = {
-  /**
-   * ⚠️ `scan`, `status` AND `action` ARE DELIBERATELY NOT ATTRIBUTES. All three are advisory
-   *   strings ZFS rewrites on its own — `scan` on every scrub, the other two as feature flags and
-   *   faults come and go — so keeping them would rewrite this resource's state row for reasons no
-   *   declaration caused. Same reasoning as `digest` in storage.ts.
-   */
-  attributes: (live, props) => {
-    // ⚠️ A detail answer with no `name` is not a pool. `name` is non-optional in PVE's schema, so
-    //   this is a shape check rather than a default — and "absent" is the honest reading of a
-    //   reply that does not describe the object that was asked for.
-    if (text(live['name']) === '') return undefined;
-    return {
-      devices: leafDevices(live['children']).join(','),
-      errors: text(live['errors'], 'unknown'),
-      name: props.name,
-      node: props.node,
-      state: text(live['state'], 'unknown'),
-    };
-  },
-  collection: (props) => `nodes/${props.node}/disks/zfs`,
-  createForm,
-  endpoint: ZFS_POOL_ENDPOINT,
-  /**
-   * ⛔ IT ALWAYS ANSWERS TRUE, AND THAT IS THE POINT OF THIS FILE. A pool that is there under the
-   *   declared name on the declared node IS the declaration, because there is nothing else the two
-   *   can be compared on: every create parameter is write-only (see the ⛔ in the header) and
-   *   everything the read does return is telemetry that moves by itself. So declaring what is live
-   *   plans as `noop` — the only honest answer available, and the one the live cluster needs:
-   *   `rpool` exists on node-b, node-c and node-d with nothing about its construction readable.
-   *   ⛔ ANYTHING ADDED HERE IS A REPLACE, NOT AN UPDATE. `updateForm` is omitted because PVE has
-   *     no PUT, so `resource.ts` turns a false into `{action:'replace'}` — delete then create — on
-   *     a family whose delete is `zpool destroy`. A comparison added here would be one plan away
-   *     from destroying a pool over a field it cannot even read back. If a future PVE grows a PUT,
-   *     add `updateForm` FIRST and only then consider comparing what that PUT accepts.
-   */
-  matches: () => true,
-  path: (props) => `nodes/${props.node}/disks/zfs/${props.name}`,
-};
-
 const ops = pveOperations(spec);
 
 /**

package/src/release/catalog.test.ts

@@ -5,7 +5,9 @@
  */
 import { describe, expect, test } from 'bun:test';
 import { binaryProblems } from './binary-form.ts';
+import type { ReleaseCatalog } from './catalog.ts';
 import { catalogBinary, catalogDirectory, catalogProblems, identifyBinary } from './catalog.ts';
+import { OPENBAO_RELEASES } from './openbao.ts';
 import { BinaryRefused } from './refused.ts';
 import { VICTORIA_RELEASES } from './victoria.ts';
 
@@ -93,4 +95,73 @@ describe('identifying an installed file', () => {
     const archive = 'cbe83f1d409cbb85fbf1c890c4a9b7fd34c1d74acec4dce2e0ebe46fcb260e38';
     expect(identifyBinary([VICTORIA_RELEASES], archive)).toBeUndefined();
   });
+
+  test('by a COMPUTED digest, same as a vendor one — OpenBao pins bao only there', () => {
+    const computed = 'd476d17e81a35e6d70dd7e86a8ab2a3664313525118f1f1cfe0130e7a2b95f3a';
+    expect(identifyBinary([VICTORIA_RELEASES, OPENBAO_RELEASES], computed)).toEqual({
+      binary: 'bao',
+      package: 'openbao',
+      platform: 'darwin_arm64',
+      vendor: 'OpenBao',
+      version: '2.6.2',
+    });
+  });
+});
+
+/** A fabricated one-entry catalog, only to exercise the `computed`/`members` overlap refusal. */
+const doubled = (extra: {
+  members?: Record<string, string>;
+  computed?: Record<string, { sha256: string; recorded: string }>;
+}): ReleaseCatalog => ({
+  packages: {
+    thing: {
+      binaries: { thing: 'thing-bin' },
+      versions: {
+        '1.0.0': {
+          any: {
+            asset: 'thing-1.0.0.tar.gz',
+            checksums: {
+              recorded: '2026-09-23',
+              sha256: 'a'.repeat(64),
+              url: 'https://example.invalid/checksums.txt',
+            },
+            // ⚠️ Spread, not a plain key: `exactOptionalPropertyTypes` treats an explicit
+            //   `computed: undefined` as different from the key being absent.
+            ...(extra.computed !== undefined ? { computed: extra.computed } : {}),
+            members: extra.members ?? {},
+            repo: 'example/thing',
+            sha256: 'b'.repeat(64),
+            size: 1,
+            tag: 'v1.0.0',
+          },
+        },
+      },
+    },
+  },
+  vendor: 'Example',
+});
+
+const THING = { binary: 'thing', package: 'thing', platform: 'any', version: '1.0.0' };
+
+describe('a member pinned twice, once vendor and once computed', () => {
+  test('catalogProblems names it, rather than silently preferring one', () => {
+    const catalog = doubled({
+      computed: { 'thing-bin': { recorded: '2026-09-23', sha256: 'c'.repeat(64) } },
+      members: { 'thing-bin': 'c'.repeat(64) },
+    });
+    const problems = catalogProblems(catalog, THING);
+    expect(problems.join('; ')).toContain('pinned twice');
+    expect(() => catalogBinary(catalog, THING)).toThrow('pinned twice');
+  });
+
+  test('computed alone resolves; vendor alone resolves; neither refuses "no digest"', () => {
+    const computedOnly = doubled({
+      computed: { 'thing-bin': { recorded: '2026-09-23', sha256: 'c'.repeat(64) } },
+    });
+    expect(catalogBinary(computedOnly, THING).sha256).toBe('c'.repeat(64));
+    const vendorOnly = doubled({ members: { 'thing-bin': 'd'.repeat(64) } });
+    expect(catalogBinary(vendorOnly, THING).sha256).toBe('d'.repeat(64));
+    const neither = doubled({});
+    expect(() => catalogBinary(neither, THING)).toThrow('pins no digest');
+  });
 });

package/src/release/catalog.ts

@@ -13,16 +13,55 @@
  * ⛔ ADD A VENDOR ONLY AFTER ITS OWN WALK-DOWN (docs/release-binary-catalogs.md): its checksum
  *   format read byte-exact, and its binary's linkage measured (`otool -L`). Vendor binaries were
  *   measured self-contained ONLY for the five Victoria ones; that is not a property of "Go".
+ * ★ `computed` IS A SECOND, LESSER OWNER OF A MEMBER'S DIGEST — never the vendor's, always ours,
+ *   for a checksum file that never lists the member at all (OpenBao: archives and SBOMs only,
+ *   never `bao`; docs/release-binary-openbao.md is the walk-down). `checksums.signature` records
+ *   how the checksum file's OWN authorship was checked, if a vendor publishes one to check.
  */
 import type { ReleaseArchive, ReleaseBinaryProps } from './binary-form.ts';
 import { BinaryRefused } from './refused.ts';
 
+/**
+ * A member digest WE computed, because the vendor's checksum file never lists it — read
+ * checksums.ts's header before adding one: most vendors list archives only.
+ */
+export interface ComputedDigest {
+  readonly sha256: string;
+  /** The date it was computed, from the archive whose pinned SHA-256 matched that day. */
+  readonly recorded: string;
+}
+
+/** How the checksum file itself was checked, beyond its own SHA-256 — openpgp today. */
+export interface ChecksumSignature {
+  readonly kind: 'openpgp';
+  /** The detached signature asset's URL. */
+  readonly url: string;
+  readonly sha256: string;
+  /** The public key it was checked against. */
+  readonly key: { readonly url: string; readonly sha256: string; readonly fingerprint: string };
+  /** The date `gpgv` was run, recorded once — never re-run at apply or by CI. */
+  readonly verified: string;
+}
+
 /** One release archive as a catalog records it: the pin, plus where every digest came from. */
 export interface PinnedArchive extends ReleaseArchive {
   /** Archive member → its SHA-256. Every member the vendor's checksum file lists, not just ours. */
   readonly members: Readonly<Record<string, string>>;
+  /**
+   * Archive member → a digest WE computed, for a checksum file that never lists it (OpenBao's
+   * lists archives and SBOMs, never `bao`). ⛔ NOT A VENDOR FACT: computed from the bytes of an
+   * archive whose own SHA-256 already matched the pin, never filed beside `members`. A member in
+   * both is refused (catalogProblems) — two owners of one pin is a data-set bug, not a choice.
+   */
+  readonly computed?: Readonly<Record<string, ComputedDigest>>;
   /** The checksum file the digests were copied from, its own SHA-256, and when. Never fetched. */
-  readonly checksums: { readonly url: string; readonly sha256: string; readonly recorded: string };
+  readonly checksums: {
+    readonly url: string;
+    readonly sha256: string;
+    readonly recorded: string;
+    /** How the checksum file's own authorship was checked, if at all. Optional: not every vendor publishes one. */
+    readonly signature?: ChecksumSignature;
+  };
 }
 
 /** One package (one archive per version and platform) of a vendor. */
@@ -60,6 +99,20 @@ const quoted = (names: Iterable<string>): string => [...names].map((n) => `"${n}
 // ★ A plain boolean, not a type guard: on a `Record<string, …>` a guard narrows the miss to `never`.
 const has = (record: object, key: string): boolean => Object.hasOwn(record, key);
 
+/**
+ * A member's SHA-256, vendor digest first, then computed — or `'both'` when it is pinned in both,
+ * which is refused rather than silently preferring one owner over the other.
+ */
+const memberDigest = (archive: PinnedArchive, member: string): string | 'both' | undefined => {
+  const vendor = has(archive.members, member) ? archive.members[member] : undefined;
+  const computed =
+    archive.computed !== undefined && has(archive.computed, member)
+      ? archive.computed[member]?.sha256
+      : undefined;
+  if (vendor !== undefined && computed !== undefined) return 'both';
+  return vendor ?? computed;
+};
+
 /** Everything wrong with a request against a catalog; empty when it resolves. */
 export const catalogProblems = (catalog: ReleaseCatalog, request: CatalogRequest): string[] => {
   const entry = has(catalog.packages, request.package)
@@ -97,9 +150,16 @@ export const catalogProblems = (catalog: ReleaseCatalog, request: CatalogRequest
     );
   } else if (found.length === 0) {
     const member = entry.binaries[request.binary] ?? '';
-    if (!has(archive.members, member)) {
+    const digest = memberDigest(archive, member);
+    if (digest === 'both') {
+      found.push(
+        `${request.package} ${request.version}'s member "${member}" is pinned twice — once as a ` +
+          'vendor digest and once as a computed one; a member has exactly one owner',
+      );
+    } else if (digest === undefined) {
       found.push(
-        `${request.package} ${request.version}'s checksum file lists no member "${member}"`,
+        `${request.package} ${request.version} pins no digest for member "${member}" (checked ` +
+          'the vendor checksum file and any computed record)',
       );
     }
   }
@@ -118,7 +178,9 @@ export const catalogBinary = (catalog: ReleaseCatalog, request: CatalogRequest):
   const entry = own(catalog.packages, request.package);
   const archive = own(own(entry?.versions, request.version), request.platform);
   const member = own(entry?.binaries, request.binary);
-  const sha256 = member === undefined ? undefined : own(archive?.members, member);
+  const digest =
+    member === undefined || archive === undefined ? undefined : memberDigest(archive, member);
+  const sha256 = digest === 'both' ? undefined : digest;
   if (
     problems.length > 0 ||
     archive === undefined ||
@@ -163,7 +225,8 @@ export const identifyBinary = (
       for (const [version, platforms] of Object.entries(entry.versions)) {
         for (const [platform, archive] of Object.entries(platforms)) {
           for (const [binary, member] of Object.entries(entry.binaries)) {
-            if (archive.members[member] === sha256) {
+            const digest = memberDigest(archive, member);
+            if (digest !== 'both' && digest === sha256) {
               return { binary, package: pkg, platform, vendor: catalog.vendor, version };
             }
           }

package/src/release/fixtures/openbao/checksums.txt

@@ -0,0 +1,83 @@
+a7784550a9db16f24e99d65a18c9b12a433707c79ef4c1f34262d3f48171c7a9  openbao-dist-v2.6.2.tar.xz
+f19784c4c865ee66b6dda164e0535fa6ca6ac2d45e5edb7ed0e0a5dc08bd9c3c  openbao-hsm_2.6.2_linux_amd64.deb
+2c4ec5c393d7b8c69f560fd8f92ba7c9a12d70044b88f94b8b90ec27dcee9e2d  openbao-hsm_2.6.2_linux_amd64.deb.sbom.json
+8aebfef4f6537777c68c4ff6d84741aaf50a2b7c40e0ac1f9cef36e00f29fb84  openbao-hsm_2.6.2_linux_amd64.pkg.tar.zst
+2b1c9dc60858cb08bcb30f931861b6b7af7ae17135dc8f4c253b32823616f9b9  openbao-hsm_2.6.2_linux_amd64.pkg.tar.zst.sbom.json
+7242e327c66c85c3d720395a94de06b9a08b8394db18b656f3313fa2cc654f0e  openbao-hsm_2.6.2_linux_amd64.rpm
+8bd3ee543abd527031a4bc4ddcfff3d5a02a089ab89d34a18f067ff5c13539b1  openbao-hsm_2.6.2_linux_amd64.rpm.sbom.json
+340511b6f87662b80252c202a7c5aa90dbe32341ea741458d49ce6839c2d7721  openbao-hsm_2.6.2_linux_amd64.tar.gz
+dfc89e52387e4e91065b1678e7612268161e578c0e987ae745b85e0db897e6b4  openbao-hsm_2.6.2_linux_amd64.tar.gz.sbom.json
+ecbbe80b120ea108a31e8a8157f613901b7441761c882a9bc042314ac71824e4  openbao-hsm_2.6.2_linux_arm64.deb
+ee141346e8ee1c52725b08811caa92845243411a695d14bf6366fd2ef839cfb1  openbao-hsm_2.6.2_linux_arm64.deb.sbom.json
+f0444501b81f731a9c9c8f41fd41dea359a3a2caacafc2f54bc5170ccc3f5fe6  openbao-hsm_2.6.2_linux_arm64.pkg.tar.zst
+925609394ea12da34b2f94d79d8d01d8b8a2174788e4a7211ae69a3600d1d3ab  openbao-hsm_2.6.2_linux_arm64.pkg.tar.zst.sbom.json
+fff1b905c697bc5ef28e905e1ed4c670c101017f81a23bed859e7eed29faf325  openbao-hsm_2.6.2_linux_arm64.rpm
+bf13d04c98d5d7cdc7cbc608ebd20519f3879b149c60eff6b8da7af0466bb3f8  openbao-hsm_2.6.2_linux_arm64.rpm.sbom.json
+b796dae3269323a06ae198732f0c3727f8f041df9e45893a3d7ec5eeac627730  openbao-hsm_2.6.2_linux_arm64.tar.gz
+05a6e5fb308a7b5b16555d7599f99bae0d4ad9f034e7d005162f8d927d4428bc  openbao-hsm_2.6.2_linux_arm64.tar.gz.sbom.json
+64fdf1ce8f410bbc1531d2f0ea142d21b4e755b986542025a00294999a8cfaa5  openbao_2.6.2_darwin_amd64.tar.gz
+c9b5cd775a297705b46d562b5902e96071796b47f6792768eca1c38d17a4ba21  openbao_2.6.2_darwin_amd64.tar.gz.sbom.json
+4e495376174accc0e014d31e9901f518a974f966850c839f626347eaac05fd52  openbao_2.6.2_darwin_arm64.tar.gz
+d349558495345d314284fd7a554467c0e28e154a71982fdea17f1cd813101de7  openbao_2.6.2_darwin_arm64.tar.gz.sbom.json
+2f6b1f77c9ce7cb83d87a2c85d546c2bb6761cef013efe99654cef9ca5177b5d  openbao_2.6.2_freebsd_amd64.tar.gz
+30b8cc4ca539371917bd170e3f4e1ee6fb9874f8e538ba561f2811eb39b09e94  openbao_2.6.2_freebsd_amd64.tar.gz.sbom.json
+572a4995663dcb7affe6ba30dcbeed0180612f81e641db1e8c64ebe9c246c7ea  openbao_2.6.2_freebsd_arm64.tar.gz
+486da7fcc18cf266168b30e6eb88463624fbc01a195fc15a0499989b172658fe  openbao_2.6.2_freebsd_arm64.tar.gz.sbom.json
+3fc3b24dbfbb48d6b89d919b546954f376e18f90d5a6998574815d89a805a299  openbao_2.6.2_freebsd_armv6.tar.gz
+1eaaac21642f9eb018b4cdb090943c9088d8446822a464898cf69d474f0d9601  openbao_2.6.2_freebsd_armv6.tar.gz.sbom.json
+f22b703e626d03d1595c21cf1c57c8737675b721daa3b8e3972531ceafcc3993  openbao_2.6.2_linux_amd64.deb
+c176ef194d77706c09432326f8e0f029fb8d2550e66ed275854fa400d23a9d92  openbao_2.6.2_linux_amd64.deb.sbom.json
+3c1bd831cca649bd47add1d7204b64cf66266b52b0631c772cfb23af44c7980e  openbao_2.6.2_linux_amd64.pkg.tar.zst
+3dab2410454f0bb6dd4289ad4f8df14a2342a2c7b203454c34b2d6b90cf941ad  openbao_2.6.2_linux_amd64.pkg.tar.zst.sbom.json
+586262fc6e49324efeee7969798a75f72402f30ba9edc2966f73c2dcc60aa48c  openbao_2.6.2_linux_amd64.rpm
+b760636d3ff65c04fd7364211e5dec44ca53340c916ae0245af2c377255aba3f  openbao_2.6.2_linux_amd64.rpm.sbom.json
+8dc11cc5fca0b539a9e352727dacb4e2d304daffcf9a66e0718ac325a20d05aa  openbao_2.6.2_linux_amd64.tar.gz
+d29dd86fed21a16a1c5b4d0b8c785299274a4fde3976041cf545f36dc17d7df6  openbao_2.6.2_linux_amd64.tar.gz.sbom.json
+554e0f196394edc5b35267dc8888e28eaf0f3a7de01271f232c5d93e709b6cf8  openbao_2.6.2_linux_arm64.deb
+486a83df4a5cf3837cbede91b147f402a8ce264073886eafdd95189015092ed7  openbao_2.6.2_linux_arm64.deb.sbom.json
+a7ff5fb158597a241d3cac77770034b77366d04048ea8d6bf51ffed16355fec7  openbao_2.6.2_linux_arm64.pkg.tar.zst
+02711ec8581b8a26819f038c043bdd874919d48dbec47ea8dc60a4e60ffe288a  openbao_2.6.2_linux_arm64.pkg.tar.zst.sbom.json
+1bedfbe3a24925c0e037564ea4504a8890aff7924fb72d6d699118d3cf8d61b5  openbao_2.6.2_linux_arm64.rpm
+e8a7e5d81e07c772489f573965a3a8fba03b52dbe57ed7e8afde2186a6c896bb  openbao_2.6.2_linux_arm64.rpm.sbom.json
+1b408e01f3565ac0cbcb88d637dca271d0515148fb72efdeff4473a34fa50c4e  openbao_2.6.2_linux_arm64.tar.gz
+f3b4b4757a685d922244b738edf0d23143f4ce66155758cc280e6131dd225d60  openbao_2.6.2_linux_arm64.tar.gz.sbom.json
+d2a5e2d0d66bd64ee1669902905010747dbc13f1662871b95f9fc53b2c8207d7  openbao_2.6.2_linux_armv6.deb
+407c5b21216eb8422813d822f0b6a524bb7b0600a2acc4fd880a71396676de8a  openbao_2.6.2_linux_armv6.deb.sbom.json
+f40ad101126827474857f21d0b43bb481209e1c728bf3a0d5afd786df773999e  openbao_2.6.2_linux_armv6.rpm
+40bd8f614ad2951d06b9dc60fc12bd2fb6ccc917ab7f2154fe004a7df64fcd5a  openbao_2.6.2_linux_armv6.rpm.sbom.json
+7c7d37409d9898d0203a3000fe9e51dece44ef57bd92daffeedd9cc75ee5a35e  openbao_2.6.2_linux_armv6.tar.gz
+95cd1d1e268e3d5f410f0b085b2b2038e1bf7a682057521ebf68e3a87e89a99f  openbao_2.6.2_linux_armv6.tar.gz.sbom.json
+b0b385406d52491b53c5d7d550b88fedd8ccb85ec159c6093a536b101bb6ea24  openbao_2.6.2_linux_ppc64le.deb
+f3c5e4309ec51e02c2c8e65178aa55af80dd3f0c077a544ad275300757b09de5  openbao_2.6.2_linux_ppc64le.deb.sbom.json
+166ae4749775f63d1396a6be584f1828b9412efc1a50861ed6815286a4baeae9  openbao_2.6.2_linux_ppc64le.rpm
+aa489019a315045c37c046340c0d1f16a0dd694432f901551325af6f334b147f  openbao_2.6.2_linux_ppc64le.rpm.sbom.json
+5288e7183dc7844cd3b025f33f140856797b6a93674d9637dcf070b9c081da3d  openbao_2.6.2_linux_ppc64le.tar.gz
+4571e8e4315d20a5760d90d340e2dd4e8dff763b540416e1a17ee52e7b39f158  openbao_2.6.2_linux_ppc64le.tar.gz.sbom.json
+f0d06b2efb2a0717cbcc33efa2ec6416a76bb1842d22a4e84deff016a5ae9981  openbao_2.6.2_linux_riscv64.deb
+c3350ebc21aa1815d8bd6f22cb1eeb0239f49cfe66566178b91605627828c362  openbao_2.6.2_linux_riscv64.deb.sbom.json
+5d4c85e8dade07e58bedfab1e56823a5a9e68fa2b9830b88480c0083f305d6c1  openbao_2.6.2_linux_riscv64.rpm
+b78a5a4f448cf4d4339543cef969b6680172d0c3b30ec18aacd8ce17ddd048fe  openbao_2.6.2_linux_riscv64.rpm.sbom.json
+177614c6371194c2318a5cf415a3a141337a0bf5e3092de3fa291185dfe9f695  openbao_2.6.2_linux_riscv64.tar.gz
+aef41cf1b5b1e10fb0b679c6e119b4e90123fe7bff3243f859df3bca206427e1  openbao_2.6.2_linux_riscv64.tar.gz.sbom.json
+2b2c2474e69728361263a636798408f6744ad9bba891db60b0e8a8bfdf4a2c81  openbao_2.6.2_linux_s390x.deb
+d4d6253c90ebf5ce4d295011062ea1eb9d4c02d805ec965b02650f38802e723e  openbao_2.6.2_linux_s390x.deb.sbom.json
+33f30660dfbfcfe0d5804939329128d0025d37a9b887f3e1b2450fd4591a10c6  openbao_2.6.2_linux_s390x.rpm
+a555bdec0e39ced1400199f9c66a59c6215d747b32cf2672078c321d20119302  openbao_2.6.2_linux_s390x.rpm.sbom.json
+dd987c5d69dfe93bf918c7f4fd7aee438fc60d5f292c84ed670aec95b6943daf  openbao_2.6.2_linux_s390x.tar.gz
+663c48d0dfcec4835ba26a36b4bea4ed1795cd7c917eb511ed6c93ca39d09d73  openbao_2.6.2_linux_s390x.tar.gz.sbom.json
+8dc6d8f19148b87d41b4f7eb87944b27efd93f624c4e4838fc66380d0601a3a8  openbao_2.6.2_netbsd_amd64.tar.gz
+88533203c066d62a24fd3c7e4b0c8f8166d3bab0c3d2881da6318a224099b208  openbao_2.6.2_netbsd_amd64.tar.gz.sbom.json
+7639564e055a8523d73e6efe0ed950bf25ead0c1e8661db4b5a32a6c8e35b75c  openbao_2.6.2_netbsd_arm64.tar.gz
+3c0c3d2bddee7a4be2e1393ffdf7b5f8ab439747d649340b747eedb4be1f0b76  openbao_2.6.2_netbsd_arm64.tar.gz.sbom.json
+0e39bcbbbae69a4def27922080cc47ba1b42ea67308f101c47584ebd24dfe544  openbao_2.6.2_netbsd_armv6.tar.gz
+c25e9f9065f2d5484091a40dc5c797ff40a19fad0382bb48f60b3e0a469bb294  openbao_2.6.2_netbsd_armv6.tar.gz.sbom.json
+289d17cb38f0007beaa71ced90b6c7e34d2e3a190d997d7865b6c277d8a703b2  openbao_2.6.2_openbsd_amd64.tar.gz
+15c6f1e5fc54d89a2ba455b76c16ec5bff81f4c48a299117dc58d5aaf383588b  openbao_2.6.2_openbsd_amd64.tar.gz.sbom.json
+faa52e6ae74544192ed6fbd40ca631d808c1ab480067adc61450eb3a550a649c  openbao_2.6.2_openbsd_arm64.tar.gz
+a11cd6d9269c10f386f34d6051fd3089d94808226f4e2113ceb914c9e215ad2a  openbao_2.6.2_openbsd_arm64.tar.gz.sbom.json
+4002255fe061cec3f8e4494b4bb2464a79abfd67ea683ce16b3ae73ab004e151  openbao_2.6.2_openbsd_armv6.tar.gz
+dc8fe407c9917f3b4e8c9593782c591f70b23e6e8e05642b67f852527dbd6830  openbao_2.6.2_openbsd_armv6.tar.gz.sbom.json
+12e8d40c71fe5a0aa23062c6c36a77a96717005980e30d0d42acdea3268d3fa2  openbao_2.6.2_windows_amd64.zip
+b19219d3795e772b53a81cee1deaf1139364411e2c57359d0745cda9afdf097e  openbao_2.6.2_windows_amd64.zip.sbom.json
+e4fa1edb95129c36a36cfc5ad1b96198208344df42f66371b14fe579328ec662  openbao_2.6.2_windows_arm64.zip
+179c8de71459d2d6059939b23ab9b5012ace519340820c1beabcd882364fae7c  openbao_2.6.2_windows_arm64.zip.sbom.json

package/src/release/fixtures/openbao/darwin-assets.txt

@@ -0,0 +1,12 @@
+openbao_2.6.2_darwin_amd64.tar.gz
+openbao_2.6.2_darwin_amd64.tar.gz.gpgsig
+openbao_2.6.2_darwin_amd64.tar.gz.sbom.json
+openbao_2.6.2_darwin_amd64.tar.gz.sbom.json.gpgsig
+openbao_2.6.2_darwin_amd64.tar.gz.sbom.json.sigstore.json
+openbao_2.6.2_darwin_amd64.tar.gz.sigstore.json
+openbao_2.6.2_darwin_arm64.tar.gz
+openbao_2.6.2_darwin_arm64.tar.gz.gpgsig
+openbao_2.6.2_darwin_arm64.tar.gz.sbom.json
+openbao_2.6.2_darwin_arm64.tar.gz.sbom.json.gpgsig
+openbao_2.6.2_darwin_arm64.tar.gz.sbom.json.sigstore.json
+openbao_2.6.2_darwin_arm64.tar.gz.sigstore.json

package/src/release/fixtures/openbao/openbao-gpg-pub-20240618.asc

@@ -0,0 +1,109 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGZx4nABEACnQllkFhq8bMuf9cgEqtpuJ133TWogetAW21nQUL7mKaPrrSdC
+S63wR5hCTiSLpoBFSNACUTYINviIDcmseq54peOivGBQvw5ywZAznPDX7DqrrOP/
+Cr6YYfIdK3bVA8filgio/NgRRaUXY0aUkUceKJhF1sjRWJoJR5nkZ6ltaHwgiW2P
+mGb7stRPcn0Qa3gikbv/BTCxqKg7frQLsswcsb7lVJ/1d8xODLBQnwOFCCUwnTUV
+7UL/6L7QV/hl0sBLSdmFDVVHnPAlCo46BL2LfaFRcJC123Uw4xJWaL+eN7x+hFZX
+meVdDIgGWUilZM3Vau0au7i8eMwi5ezczrU/bHm7q+KnCi0KivUykDmngK4FQdC2
+YkZo3mYTEnFdlfp7e4KHFB+2Yc2AgziwRbxDEuPTRTcIKfr7nlqiPEAbJSqmwQlt
+u5dHYeqz6ZaeOZ3S+PqVDgznhZw1PVx0qDI5gdJY/WqlwvgjOaG9s3LwMezWvLub
+P2JhpgpcXpNh1R+ShwHCawjGeJxL7GS5X0qYoarAaRdJKKsPt1dBFSyuLhwfuGL0
+CaXqma5WklZDyMnAqdEufFE2bVhYZZPm7E/4O+AvNIZAeMthn1QaQnwH4pQP8H0r
+jODxp+Sr0X6hmx07GDlzkvTaD7DjibqMyad5tBij4AdMYX0vTyLupVIXkwARAQAB
+tCJPcGVuQmFvIDxvcGVuYmFvQGxpc3RzLmxmZWRnZS5vcmc+iQJXBBMBCABBFiEE
+ZtFf3YcochnI4VR40gDNcChT5tAFAmZx4nACGwEFCThkCQAFCwkIBwICIgIGFQoJ
+CAsCBBYCAwECHgcCF4AACgkQ0gDNcChT5tASvw//Wx21z9DAKHuHn597UB/O9wXz
+OkhHedFEq89z6+oJj7lvpnwvK5kRqnqiajerZVcbJCeq2o55qK5Q+YQFIMzJungt
+zbT1d2QM99QWHq2oJD6YB1y0eUvYe+h8kLh1ljPPflLngrZJH+OtqavaIV3TS874
+o6taePVyIuGRyKrQWBaYnSra7WYoeHgLqVx3KVdIwowWI48wDfBsfs5quOzJMkdg
+kbxOFgb3rMtPwW72yQGN0I7xLNZQkSchgFjuX6Ue2Q8QOCkkVn1qmf1aSgavGvpW
+EcGeMGvdZlzVR451/B5NKvVWFsoT3filUQzJeAN2TiNj09wr8JyIrOxf6j0vnrwD
+ClrMVdtT5yDf+ZkPBya2igISPmhuKc2jezroXu7FEqzKcXsJQSV6DWhzb0RDZ00S
+2pBDDs4jNGm/svwbwfz7DaBz6PnfTIZfN0ytBcGZ8OfWHksb73GvR94UIm/B8FgQ
+9911xfaj/rZOd1NoL8DEw1s4KY/QRJZgKLcBh5L/AU1yZR5dUsqg88LtDCgohnug
+jMVwJFsqiAF/nsfClU/pLwNCb5MP0u9rWKt+88DLc1hVUoKJn2sb6OhQeBpcZB+v
+ZKcg8OM4QsY4LRWOzi5DtA6YnBYL01C0pLal6RNAnprtKaxlaoEJLlO43rJdnDSM
+llN8DKC2PndsTqVofj25Ag0EZnHjqQEQAMyuoe8era7DvgkzY0lmKiILVFs9TroV
+dFMaN+oGdphpn/uwrU+/gEzGemm23pkJuRpY1joS9NRyxAObIcLQulL7dcsyiRTl
+m8fz6eSUlgVHrysGuArGolJRLy/BOgN0YMq5YB5N6dbzECUu7I13GmumLyxeVkTV
+Pjvob91xqHJ/8JBmTmU+VQ4/SciBfvCPUHCKUA5iP5b3YLjN7zNzZ2ZmUs4AxqWS
+lVrI1HZi/K1sLqCmzjIjG3Pc3JiK4Ox87JZWsv0ZGUJwgCdgthLe/fyaUuvZtfv0
+Y/4e+IO7YnrekWGy3sHqSO8npdlPpwzlTlmOqHx2VpG5DlUCDy8qh4o8ya/u5YEq
+Osd1Z04PsRLzB6Rl/D/lWsaztDp2Ec2U/Bv3R+bswPlIuPe3got1Q1768GQadSz6
+PoxzDXBfS+Qk3do6kCsm7AUGlmH/M0SByA7kYt/mpkPrsCaF7TWUcR6p0j/VsAI7
+Lk0ipYxYly8SRKARyAR811D+QFxmhLcQNTLdhxSAKKZS4n3qp3xuGQ5qfItsAFwR
++8qH19iOpLhWm/3Rgolt19G+gVUkyZEB4c0OrwAEcgHZrIgmtnELnKoAn7LJsZh6
+n3heef5gmRPPF66dqXKYZTA3TrZjKJXE0C0B+3V/qaV6SNkfWhf5WGwqJ7Ot64pJ
+vr53uj6PRaflABEBAAGJBHIEGAEIACYWIQRm0V/dhyhyGcjhVHjSAM1wKFPm0AUC
+ZnHjqQIbAgUJOGQJAAJACRDSAM1wKFPm0MF0IAQZAQgAHRYhBOYX3NQGXCr8Cyz3
+p7qLwIwPaR+UBQJmceOpAAoJELqLwIwPaR+UQx4P/0icW/kHRw/7xN24pJP2CnmL
+Rga6M2H8hV4jwc2AuFuVsi/QsZKosHtFnISitl+w3crhjb/dA5ugfeQmuZpyaem0
+OIk0nJLzBEdyRBTdR4b6MvraaU63KIYN6QPdHZtmFSd99MRCh6wz+S+H+K7yIDRJ
+Ok4dZ2oGzQReLymsK1Ebpxl4KOlh0fT2Jz98i2enpz3AvPBJJEh6yf3/6cqb4jOa
+37RVU2fuTaYVv6WwekoqkLnec0pDPuz8LUSx9yOsmXff/g+ONge8vK/EngQu5gxw
+pbmF39Ki2rlFAS6yMo4SU7C+UMcx4fa4Ysa0ZByx0iy7hhRG6XhjTWEP8TZx3tGC
+JCQ4/eAjpjFPQFXeOcjJcAtVb1bQCr5f+xNdMYedIaP4RbFLfhuKaMiTzrwm1Vcc
+EwV4e93oPGjYwMW72XXQUgpbDiRITYYuZ3D8h2Gu3IM1ptMlCZ9cKXfkl4TKDoyx
+ZtHDGMpKlXqjgYWRweeq2ZYf5y+rL9Me0/rh4JcYUInTn/XXgw/OyP9dSJjbClJ1
+JCrLYBbZwofdSj0IgOA8riMzsKZBlSzS9TMfZ+QjuMSea7tYPgYNh5IwS6g8obNR
+MkAZbwc0i9wSe3nohVcI7yEYilvkd4XaO/59KUrrR3piBvcotHx1QZ4M9w7BQx3r
+a3e/4l2OHp7qP002DjRe0d4QAKV7971qxuAiTBkppf+KQo2Yla0xJbQUNwEHWHfM
+YrUXvpPrHmID5jCR4+RoVvoxD2QGlj7mRhfv6m+J0WiE1k/4YEFxL+a4IupcLETT
+n+p4bRdkVcV2a5ujrHxLU9sPtEXPGQhMjDH43FRJWNiJDIXWTBgaE2QVLpWT5ebe
+qmxYBxDmexwJkiWjtBE2BO3NBxAVAw5iIvwxaSQ5pwHKQb1QeNeNVwcXOHz3t/t5
+/n0pct/RD8N6hyae0fgJwjnauqsmf05nkI0xX8gdm9zaTSEFEaL3oLrRDQ+K62my
+BL8DGTF9FFKV3n7lIiAhWG6OelWc4OmOnqExMb7KAZbsOzpN0Xq+S9+sFOlBhMJj
+hi4pzT6ScnFglK4rQsX0dOS8oHToCXOxtzFj2WFUOnm7qtyQGKf+rpBnThvro+ep
+VY3L+BDLGAMhHZsk+UAtN9a8kVGVlXrDKeFd18JMlGtxqCNVC6PGm7TEVQJ9GU2d
+M19dmvNlRud4Jy4yaKp8KtJ175xPFtF4K8REiQN1XH7GIp70UWOifxSrkuYHf6ac
+/2gUPx/f77XNOhECfEzR3qJi5/AgucxM4F69iaHQUVBTjiyocmQwN/eD+VrvlC4e
+c4/joxuECGIF5ElE9A6d7zKkEXl18m1eZQ15tvkFyTr3TWy/b/khRTQgW33OQPpK
+p3K7uQINBGZx5RgBEAC3Qits8vR4XzyHbTc9nBcquyuy8I6uYaaixEegMZRGfM62
+RmgZjyGTDGF1vwmgQb0wha35b9DD33qnDb/Ea/yhUCY43nyDdvWzjIzhPTRRTn+O
+5vI48PlGGzm6VHiUrO+Ds8cGbTqalzW/04ARLEHu+1U27B8+6vi9Pd+63MJl06rZ
+r6F9F6lmG3XCqtXpGUv1NTI0vuOosElny546S99IqcA1TG68XozsW3mNv3R6EQb2
+YEUlh3cANvWsNGDK5gH/l7Z+PsZvJW3z2bqWkD6dU5HmEE03KnNSAbs7H1Jvt6y6
+kJjTo1QwTmapEf6VZ/YJigVC4YiOmdKeqr8rIWiW6dFH7YEXOjzDlWubJw+qNz1N
+oN/wJtEPG0AF4QC14G3qGi0Gzw5mcZXzC+9zXJnrdNRae2PRxpSzHfSjS8vHXwNV
+oE2G5zzsnfjF5MV5e4H07mBSZ0/NZiWnkN735CaFVgXSh7MSpm8q1L4H4NL0aMFr
+c91HvZo7wiNMp/vDv3Tw1Mx+H9+E2djWfazfRP6SMXuEYSH1h7EAcDWWhEdIhZcC
+OIoLuL/esuaK6PUxvUxDeR7M0HiyarLwUbsCSmOz2QbuMqtFmIIPNJO/ohmNC8et
+9WvDAMOGkSZ3wHfyFL5yD1sLeN2FE/B1M0F/9eLttmDaOBjY7NtRCB2zzZ8FLwAR
+AQABiQI8BBgBCAAmFiEEZtFf3YcochnI4VR40gDNcChT5tAFAmZx5RgCGwwFCThk
+CQAACgkQ0gDNcChT5tCXIA/+PQ4WN9+pdeo7kgVjtyOz3XqQOoo+Cg01jIEmSS0r
+iN/QK7iwWlxnHrhGdSjIvjM+Frx0dNGJJGaat4AVCkfo5v33SfTvn/5luS4rQiVu
+TDOOIvv5d1cs8NO9kzwNBk8zMzUMad0XDiayeNGy30PUock5Qiv+oFZJ1OjiSfJ0
+DNhhcEUogDvUXaeMXY9DBxAq1SDQZZSh5M+xspuPAfw3oz17Ix07DVijqTY8FStA
+GANGzqtty4lfYKJuraYOnI83hQYQSO+OT01okldrUZE5WegMhrwi9prIleHjyOdF
+2z6goRSH6jraYCpIXbyzLn91nYGm6Os8p0Bgvv6aFicNXKJ7XOLAh7UcCvKVrfrn
+nGIywFbOAxp/lEKAZrPQ8HYjMCbOYqntw1+4BbcgART9y9OY7xNFGxRn3kdxGD/0
+ue65RfY1IikPtZDNHGTYft2N3pI802VvlK4gizRSg9OJ4Tvs2x0sSxD9/P4wlwga
+B6hw4NTXUre2bFUezE2gvHAnzKf6kN/59hmsQBB0QGOo9Bdt+c/17yT/TImGaf2E
+XGyohhRqHw0vTn8GgnQtPQoip9cnDzU5c/MpS28A4yGxG46fIpMRIJ7bX1k/V0Az
+Fd9lHWrRp+XQLjT/Y28NrFKHgOWKZZfTC+K5zax2sEezDFIMSpCmBy3rLjLl2JbY
+f3S5Ag0EZnHlvgEQANi0HuC3XJiEQhlD+qciZW9fPSqsgPL0wX+x9qICBLuueWQk
+5wZ+Oo476/VVy4Q6bGU/lpyDN2tiv/CQ/vejFsau90qMMsf1QlAVwNC/QFrUhDnZ
+vjPjajORZuSad22efnRa8+PLTk0Iow/aqQefv0esINl6Ial7fEuBP0BG+BzU0c7+
+zKHjAcqVwqtzyn0my/PqBlsXLJthwjqCiBMBLwf8BwkCsYEdOysHpsEZJUF4mQKs
+Cm6QRSZylyyHnFvAk4RiVdVXZDx8HyIiKQw22H+kUYR6y6977Gi9dV2zOzwIgY43
+RBBTCmiGpkbeIE6gtL1P5W8VMGwhdWVRCKK+6sB+Txlwo2iCUchuBbsVI5QoDKn4
+JvzTEVMBGNH3hkIKg2atrZJ+vOaQk5ZVdmpbcPZ7rx88zFnKS2XwRrwgO82HUSNR
+RLqUzf3bioNNxFGmtwcwTafT0feeFPFCs6TZWcaPtb32qYUdcoU+ZFXMNGk0k++Q
+rqfbMvlVD5mn2VuCG3pzmk5oxg8OfqyaUv2Rr2DgMEm2mjtDR/SSRA9g37FMihe/
+i7bRXI6JeCDQe9k9kpygvOb6lxRwScS8b5Po2YOLUd9TW+bHmaPXTnkEjfOk/Z8w
+2I7nrUz44/aL7XVf2pyzKKgoTlzM52mNvYH+WKF/0g2nz2kYsZqF61VXC+RLABEB
+AAGJAjMEGAEIACcWIQRm0V/dhyhyGcjhVHjSAM1wKFPm0AUCZnHlvgMbIAQFCThk
+CQAAAOqDEACBwdvGyhm2vO4ZsnLmfq88OR0HCa2SsdB66XBF4e9EN0d4fNQkqQz0
+6xq4Z4Pr3dIu41yrlKJhtK3wWbs4mpqGpUU4SXmlAJrh5G3QBzhoQNJwRSxBUu1H
+7wYWZDfNzALQyHzfn8KUt9j9F5J7T80Uk9yT5ni27N5oTZBFoLZvf1441qdOPvkm
+2XZiNS3/y57+N8J6x8Uk4ruE8/2c4Br008MXlX5ELmpbAW7yVFi6C+TvoM5QJgBs
+cz6wz7bz6ZLtZmAeRZACx8teNr5sl64lKdZ74fVibPxQ2zYJLs/MCJ8H3hcjLAk7
+RGfuZMKTmiacTihTTxtrQH7l6kB5oTYLkEZ5anP+Rl1m4PtHj/L7td/Af1iBBfdm
+7MM3utNxRmQUC0lYw/058riksFWLQfHvgb/yICXG2TN0Q+75MHbnXknsi+8amw0z
+Rb50sYi2GBa5NII+gj+2jXtakz2RlWhN0+XuTtBMHKNLpe1qh64tLrVjHGivAZwi
+wIUySjVgdn9TKStReSyaDLUuYWnd3g2bKlBRjA0AIixnkEGxgajk5moaLpTHmXv4
+qsIrrWjvFS0QOmuChHODqPKVR6T681HbElUkhDOBnMgRMyWxRc6WWV06IUrXZOdD
+HJyC+hbV9j8H8Hwvq1RKzHeMaofejSqTJxBR8wExXC12PN7uon0DCA==
+=coUG
+-----END PGP PUBLIC KEY BLOCK-----

package/src/release/index.ts

@@ -22,12 +22,15 @@ export { ReleaseBinary, ReleaseBinaryProvider } from './binary.ts';
 export type {
   CatalogPackage,
   CatalogRequest,
+  ChecksumSignature,
+  ComputedDigest,
   IdentifiedBinary,
   PinnedArchive,
   PinnedBinary,
   ReleaseCatalog,
 } from './catalog.ts';
 export { catalogBinary, catalogDirectory, catalogProblems, identifyBinary } from './catalog.ts';
+export { OPENBAO_RELEASES } from './openbao.ts';
 export { releaseProviders } from './providers.ts';
 export { ArchiveRefused, BinaryRefused, ChecksumMismatch, DownloadFailed } from './refused.ts';
 export { VICTORIA_RELEASES } from './victoria.ts';