Find Packages
By the end of this chapter, you will have reviewed an independent catalog's public trust material and inspected one exact release without running it. Use either editing profile; invoke each command with Alt-x, its name, then Enter.
Obtain an HTTPS catalog endpoint and its initial public root file from a curator you have chosen to trust. Verify the identity and public key fingerprints through that curator's independent channel. The runtime increment does not yet distribute a production official catalog origin or factory trust root. This exercise needs your curator's catalog; example addresses are placeholders, not a public service.
Open package-catalog-add and enter these three fields separated by |:
Community packages|https://catalog.example.org/snapshot.json|/absolute/community-root.json
Replace the endpoint and path with your curator's values. Help displays the
catalog identity, root and publisher keys and their distinct thresholds.
A display name does not establish official status. Close Help with Ctrl-G, then
type yes and Enter to enroll those exact public keys. Empty input, no, or
cancellation enrolls nothing. Each independent catalog needs its own review.
Run package-catalog-refresh, choose Community packages, and press Enter.
Refresh verifies the signed snapshot and its history. It changes discovery;
it does not install or activate packages. Editing and Save remain available.
Ctrl-G requests cancellation; wait for the completed cleanup outcome before
starting another package operation.
Run package-catalog-search and enter a package or curator name. Select an
exact version and press Enter to inspect its publisher, source revision,
manifest/archive identities, curator, policy and human admission evidence.
The rur.rot13 walkthrough in the following chapters requires that canary to
be supplied by your chosen catalog. A passing automated assessment alone is
not admission and grants no execution authority.
Use package-catalog-list or package-catalog-describe to inspect trust later.
If refresh fails or you are offline, package-catalog-doctor explains the last
confirmed cache and its usability. Conflicting content under one package/version
is reported rather than silently selected. Refine an incomplete search instead
of assuming it listed every release.
See the catalog command reference for exact enrollment, manual-source and copied-selection rules.
Previous: Packages and Catalogs | Part | User Guide | Next: Install and Review Authority