This host serves the hash-pinned packages MCUHome tools build against. Each directory below is a self-contained source: it carries its own keys, its own mirror list and its own index, and says nothing about any other directory.
mcuhome-sdk source package a build compiles fromkeys.json keys.json.sig the root keys, and the publisher keys they authorise mirrors.json mirrors.json.sig where this source's data may be fetched index.json index.json.sig which file, and which bytes, for every version <package files> plus a .sha256 sidecar for each
Everything is signed with Ed25519. The signature covers the exact bytes of the document as served, and the hashes inside the index reach from there to every package file — so a mirror can be untrusted without anything else being.
The reference verifier is a single file. Point it at a source directory you already have and at the root key set you trust:
verify.py sdk/ --anchor anchor.json
It is the executable form of the rule tools follow, and it is the same code the test corpus in the repository is checked against.
A mirror is a copy of a source directory — no path rewriting, no per-mirror layout. Copy the whole directory, serve it over HTTPS under your own name, and it is complete. Mirrors may carry one source and not another. To be listed, open an issue in the repository below.
Source code and the publishing workflows: github.com/mcu-home/packages.mcuhome.org