Protected release delivery
Signed artifacts, never webroot files
Published images are held outside the document root. A short-lived guest AIE authorizes an explicit POST; PHP records the download start, then Nginx delivers the catalogued file from an internal-only location.
- No cookies or PHP sessions.
- No token-bearing URLs or query strings.
- No filename supplied by the browser is used as a filesystem path.
Version 0 · Saphira
v0-saphira
Downloads open after the image, checksum, detached signature, and release notes pass acceptance.
- Stripped runtime imagePending signed release
Minimal x86-64-v3 boot image, expected to be approximately 300 MB.
akadata-linux-v0-saphira-x86_64-v3-runtime.qcow2.zst - Development imagePending signed release
Compressed image with the native development environment, expected to be 1–2 GB.
akadata-linux-v0-saphira-x86_64-v3-development.qcow2.zst - SHA-256 checksumsPending signed release
Checksums for every published image in this release.
SHA256SUMS - Detached OpenPGP signaturePending signed release
Detached signature for the release checksum manifest.
SHA256SUMS.asc - Release notesPending signed release
Versioned build, verification, compatibility, and known-issue notes.
RELEASE-NOTES.txt
Verification workflow
Exact filenames and the Akadata release-key fingerprint will replace the placeholders when the first release is accepted.
sha256sum -c SHA256SUMS
gpg --verify SHA256SUMS.asc SHA256SUMS
unzstd akadata-linux-RELEASE-x86_64-v3-runtime.qcow2.zst