dialectic-catalog

Signed Makina package manifests published by the Dialectic curator. The single stable entry point is catalog.json at the root of this repo.

Trust model

1. The host is untrusted. GitHub (or any mirror/CDN) only distributes bytes — it cannot forge them, and index tampering can hide packages but never fake one.
2. Everything is curator-signed. Manifests carry an EIP-191 signature over the domain-prefixed JCS (RFC 8785) of the manifest minus its signature field (domain makina-package-manifest/3/manifest); catalog.json is signed the same way under makina-package-catalog/1/catalog.
3. One entry URL. Makina's marketplace index and Kits pin exactly two things: this catalog's URL and the curator pubkey. Everything else is reachable through relative manifest_urls, so hosting can move without re-signing.
4. Released versions are immutable. packages/<curator>/<name>/<version>/ never changes after merge (CI-enforced); lifecycle changes (active → deprecated → revoked) happen only in catalog.json. Git history is the transparency log.
5. Verify it yourself. Recover the EIP-191 signer of catalog.json minus signature and compare to curator.pubkey; check each manifest's manifest_sha256 and signature the same way — scripts/verify_catalog.py does exactly this (it is the CI verifier, not authoring tooling; authoring lives in the private curation repo).

Layout

catalog.json                                     # entry point (signed)
packages/<curator>/<name>/<version>/manifest.json # immutable once merged
scripts/verify_catalog.py                        # what CI runs on every PR

Entry URL & hosting

Until the custom domain is live, use the raw URL:

https://raw.githubusercontent.com/dialecticch/dialectic-catalog/main/catalog.json

GitHub Pages serves the same content at https://dialecticch.github.io/dialectic-catalog/catalog.json. To move to the long-term entry URL https://packages.dialectic.com/catalog.json:

1. Add a DNS CNAME record: packages.dialectic.com → dialecticch.github.io.
2. Set packages.dialectic.com as the custom domain in this repo's Pages settings (this commits a CNAME file) and enable Enforce HTTPS.

The entry URL choice is configuration, not code — nothing in the artifacts references the host.

Status

Free beta. Current artifacts are signed with the public anvil dev key 0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266. After the key ceremony every manifest re-publishes under the production curator key (new pubkey, new signatures, version bumps) — do not hard-pin the dev key anywhere durable.