The registry the MCUHome tools pin their packages against — what it is, how a copy of it is checked, and what is published in it right now.
This host is the bootstrap host. It carries no package bytes and no index: it answers the one question a client has before it can fetch anything — for a given source, which key set signs it and which mirrors may be fetched from — and it answers with signed documents. Everything else lives on the mirrors those documents name.
A source is one self-contained directory: its own root keys, its own mirror list, its own index, its own package files. It says nothing about any other source, and nothing above a source has authority — which is why the source list below is unsigned and why your tool resolves the source it was configured with rather than one it discovered here.
| Source | Package | Version | Size | SHA-256 (as served) | Files |
|---|
keys.json keys.json.sig the root keys, and the publisher keys they authorise
mirrors.json mirrors.json.sig where this source's data may be fetched
index.json index.json.sig which file, and which bytes, for every version
<package files> plus two sidecars for each: .sha256, the
checksum the build published with it, and
.meta.json, what the package requires
Everything is signed with Ed25519. The signature covers the exact bytes of the document as served, and the hashes inside the index reach from there to every package file — so a mirror can be untrusted without anything else being.
This host serves the first two of those documents (plus the key sets they superseded) for every source, and deliberately not the third: an index head without the parts and without a single package byte would look like a source and would not be one.
Some names in an index stand for a set of packages rather than
for one file: mcuhome-build-tools is one per platform, and a
build that has to run on either architecture pins the family instead of one
platform's bytes. Such an entry carries a meta map from each
architecture to the concrete package name, and a sha256
derived from those packages' own hashes — so pinning the family still pins
exactly what every platform will get. It names no file and no size, because
there is nothing to fetch until it has been resolved. A meta package exists
at a version exactly when every one of its members does, and it has no
.meta.json of its own — it has no archive for one to lie
beside. Whoever wants what a platform requires resolves the family to that
platform's package and reads that package's meta file.
The reference verifier is a single file. Point it at a source directory you already have and at the root key set you trust:
verify.py sdk/ --anchor anchor.json
It is the executable form of the rule tools follow, and it is the same code the test corpus in the repository is checked against. The anchor is served here as anchor.json so it can be compared against the one your tool already carries; fetching it at verification time is not verification.
A mirror is a copy of a source directory — no path rewriting, no per-mirror layout. Copy the whole directory, serve it over HTTPS under your own name, and it is complete. Mirrors may carry one source and not another. To be listed in a source's signed mirror list, open an issue in the repository below.
Source code, the reference verifier and the deployment material: github.com/mcu-home/mcuhome-packagetool