Skip to content

PACKAGES · PUBLISH

Sign your releases
with your SSH key.

List your tool on w3bs.org/packages with a signature only you can make. You sign with the SSH key you already have; anyone can check it with ssh-keygen -Y verify; w3bs install refuses an installer that does not match what you signed. Ed25519 and ECDSA keys, including hardware (FIDO) keys, are accepted.

1. Register a key for your domain

w3bs login
w3bs publish key add example.com          # signs a challenge with ~/.ssh/id_ed25519
# then publish the line it prints, either at
#   https://example.com/.well-known/w3bs-publisher.txt
# or as a DNS TXT record on _w3bs.example.com, and run
w3bs publish key verify

Your domain is the namespace: packages you sign are your-domain/name. Proving the domain lists your key makes your account its publisher.

2. Publish a release

w3bs publish release --package example.com/tool --version 1.2.0 \
  --install "curl -fsSL https://example.com/install.sh | sh" \
  --description "What the tool does, in one sentence."

The CLI downloads your installer, records its sha256 in a release statement, signs it with ssh-keygen -Y sign -n w3bs-release@w3bs.org and submits it. Versions are immutable.

Your publisher keys

Sign in to see your publisher keys.

No w3bs CLI? OpenSSH is enough

# The same with only OpenSSH and curl (TOKEN is a w3bs.org session or w3bs login bearer)
curl -s -H "Authorization: Bearer $TOKEN" https://w3bs.org/api/publish/keys/challenge
printf %s "w3bs-key:<you>:<challenge>" | ssh-keygen -Y sign -n w3bs-key@w3bs.org -f ~/.ssh/id_ed25519
# POST /api/publish/keys {public_key, namespace, challenge, signature}
ssh-keygen -Y sign -n w3bs-release@w3bs.org -f ~/.ssh/id_ed25519 release.jcs.json
# POST /api/publish/releases {statement, signature}

The full format is in the open spec, W3BS-SIGN-1.