catalogue: pin io.telepat.ideon-free publisher (v1.12.3 anchor fix)#327
Merged
Conversation
v1.12.3's catalogue anchor fail-closes any entry without a publisher pin. io.telepat.ideon-free was the only unpinned app (the four io.pilot.* are pinned) → it would be refused on hosts updating to v1.12.3. Add publisher: ed25519:5cqj+... (== the bundle's store.publisher signing key, verified) and re-sign catalogue.json. New .sig verifies against the embedded catalogtrust pubkey. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TeoSlayer
approved these changes
Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem. v1.12.3's catalogue anchor fail-closes any catalogue entry without a
publisherpin.io.telepat.ideon-freeis currently unpinned — the only such entry (the fourio.pilot.*apps are pinned) — so it would be refused on any host that updates to v1.12.3.Fix. Add the publisher pin to the ideon-free entry and re-sign
catalogue.json:store.publishersigning key (verified againstmanifest.json).catalogue.json.sigre-signed; the new signature verifies against the embeddedcatalogtrustpubkey (iHdBWayA…).publisherline + the regenerated.sig; all other entries unchanged.Root cause (separate follow-up).
app-template/scripts/publish-submission.shdoesn't emitpublisherwhen it generates a catalogue entry, so every newly-published app is born unpinned. A companion PR patches the script to pin frommanifest.store.publisherautomatically.