English · Deutsch

Nestwyn releases

Nestwyn is a self-hosted family server. This public repository holds its releases: signed packages, checksums, SBOM and changelog as releases, plus one manifest per channel that the updater of every Nestwyn installation reads, without an account and without a token. There is no source code here.

Channels

Channel	Versions	Release name	Manifest
alpha	0.x	Calyx	channels/alpha.json

Further channels follow with later major versions. The updater reads

https://forgejo.dev.code-harbour.io/api/v1/repos/nestwyn/nestwyn-releases/raw/channels/<channel>.json
https://forgejo.dev.code-harbour.io/api/v1/repos/nestwyn/nestwyn-releases/raw/channels/<channel>.json.sig

A manifest names the current version with build number and release name, the assets with size and SHA-256, the checksum file, the signature key, the oldest client that still works and the data format versions. Its structure: schema/channel.schema.json. While a channel has no release, current is null.

Verifying a release yourself

Every release carries SHA256SUMS and its Ed25519 signature SHA256SUMS.sig. The public key is keys/nestwyn-release.pem in this repository (published with the first release); the private key never leaves the key store of the build. The updater does the same checks before every installation.

# 1. The checksum file is signed by Nestwyn (OpenSSL 3 or newer)
openssl pkeyutl -verify -pubin -inkey nestwyn-release.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig

# 2. The downloaded files match the checksums (Linux; on macOS: shasum -a 256 -c SHA256SUMS --ignore-missing)
sha256sum -c SHA256SUMS --ignore-missing

# 3. The channel manifest is signed as well
openssl pkeyutl -verify -pubin -inkey nestwyn-release.pem -rawin -in alpha.json -sigfile alpha.json.sig

Signature Verified Successfully and OK for every file mean the release is genuine and complete. Anything else: do not install it, and report it as described in the security policy of Nestwyn.

How a release gets here

1. A signed tag vMAJOR.MINOR.PATCH in the code repository starts the release build: binaries for Linux and Windows (amd64, arm64), SHA256SUMS, SBOM, signature.
2. The build creates the release here and opens a pull request for channels/alpha.json with its signature.
3. The CI of this repository checks the pull request; a maintainer reviews and merges it. Only then does the updater see the new version.

Rules

• Only signed packages, checksums, SBOM, changelog and manifests. Never source code, internal host names, addresses, environment names, logs or secrets; tools/check.py rejects them.
• A version only moves forward. Going back needs "rollback": true in the manifest and a review.
• Writing: the bot nestwyn-release opens pull requests; merging only by team maintainers with review.

Checks

python3 tools/check.py            # content, schema, signatures, release assets, version order
python3 tools/check.py --offline  # without downloading from the release
python3 tools/docs-check.py       # documentation pairs