Asfaload

A new blog post describing a small attack opportunity window that has been closed in the release registration process. It was impractical to use, but making it impossible further improves security. Read about it at www.asfaload.com/blog/2026102... #security #softwaresupplychain

Asfaload's talk proposal has been accepted by @cfgmgmtcamp.bsky.social! 2 years ago it was an in ignite talk of 5 minutes, now a 25 minutes intro to Asfaload. See you there! If you don't know it, cfgmgmtcamp takes place right after @fosdem.org #talk #security #softwaresupplychain

Two new video #tutorial: Register your repo's signers file in the Asfaload backend: www.asfaload.com/videos/#regi... and Activate your signers file: www.asfaload.com/videos/#sign... #security #foss #howto

A new tutorial #video about registering your repo's multisig definition with the Asfaload backend: www.asfaload.com/videos/#regi... #tutorial #howto #security

Finally put an explanation in docs of our trust anchor!We trust that if you publish a multisig definition in a github account,you control it.Similar to verifications @letsencrypt.bsky.social does for validating a domain's control. www.asfaload.com/docs/concept... #security #doc #buildinpublic #foss

A new #tutorial #video : see how to publish you multisig definition to your github repo: www.asfaload.com/videos/#publ... This signers file is the trust anchor of the solution, ensuring signature verification is sound. #buildinpublic #security #howto

Published a first demo of our CLI. Covers generating keypairs and reusing ssh keys (yes, asfaload lets you sign your artifact using ssh keys!).Required some tweaks to find the good settings to keep it readable, but looks ok now!See here: www.asfaload.com/videos/#mana... #obs #kdenlive #buildinpublic

It's been two weeks now that I think "tomorrow I can launch the alpha", and each time I see something important to do first. Today, I realised our backend does not sign its git commits, which really weakens our solution. So I'm working on it now... #buildinpublic #security

Published a small intro #video about Asfaload completely produced with #foss: Marp markdown slides, #obs studio recording, #kdenlive editing, #peertube serving. I have embedded it in the homepage at www.asfaload.com

When I introduce someone to Asfaload's solution, I noticed the discussion often follows the same script. That led me to write it down in a post. Take look if you want to understand what Asfaload does and how: www.asfaload.com/blog/asfaloa... #buildinpublic #security #softwaresupplychain

First marketing material for asfaload! "Self-made"(using an LLM). Not a perfect design, but sufficient for now! #buildinpublic

Deployed client howtos at www.asfaload.com/doc/client-c... . Now with demos recorded with github.com/charmbracele... Here's an example for generating a new keypair: #security #buildinpublic #supplychain

One more #breach that @asfaload.bsky.social prevents: www.neowin.net/news/if-you-... Our #opensource #multisig solution is auditable and can be #selfhosted. Check info at asfaload.com Available very soon! #security #softwaresupplychain #jdownloader @neowindy.bsky.social #buildinpublic

Preparing demos of our #cli with vhs from @charm.land And I discovered they use sigstore,an alternative to our solution.I must not forget to send them our recordings,we are so easier to use! (sigstore requires a full paragraph of instructions, asfaload is only one line!) Reach out to learn more!

Deployed backend for the first time,and ran an e2e test script on it successfully.It registered a #github project,registered a release' assets, collected signatures from devs,and made a download of the asset, checking signatures.Happy with the progress! #buildinpublic #security #softwaresupplychain

Asfaload's multi sig detects when account hijackers replace existing artifacts. From my understanding that alone would have helped in the #checkmarx attack. See asfaload.com #security #softwaresupplychain

Asfaload can now use your ed25519 ssh keys to sign artifacts! No additional key to manage for Asfaload.

Not sure it is the right order: our documentation is deployed before our backend is even online :-D www.asfaload.com/doc/ The fastest way to deploy the doc was using rust-lang.github.io/mdBook/ , incidentally a #rustlang project like us. #buildinpublic #mdbook #security #softwaresupplychain

Seeing the Axios #compromise on #npm, and as Asfaload enables the detection of unauthorised publications in case of an account hijack,I feel there must be serious opportunities for the project.Take a look at www.asfaload.com and let me know if you have suggestions! #security #supplychain #opensource

Asfaload project,aiming to provide an auditable multisig file downloads auth,passed 1000 commits: github.com/asfaload/asf... In this LLMs age,it might become an even less interesting metric,but if only for me,it reflects the time and energy I put in the project #buildinpublic #opensource #rustlang

Added a section about #llm usage in the README. The project is not vibe coded, but using llms reponsibly is such a productivity boost! #ai #agents

Trying to make Asfaload both secure and future proof by using sha256 oids in its #git backend. This has a performance cost as we need to shell out to the CLI, the libraries support of sha256 oids being WIP. Hoping we don't need to go back to sha1 oids as converting later would be a disrupting change

As my use of #ai has increased gradually (asfaload.com/blog/ai_use/), I have more #code #review work on my plate. I have just installed tuicr (tuicr.dev) in the #docker image I use for development (github.com/asfaload/age...) , and it looks very helpful to ease review of code generated by an #agent

You have to start somewhere: happy with the 10 ⭐ the project got on GitHub: github.com/asfaload/asf... #buildinpublic #foss #opensource #rustlang

In the Asfaload codebase, there was a pattern that kept appearing: using #rust enum to wrap trait implementations. It offers great flexibility, clean #code, all with full #typesafety and no dynamic dispatch. I haven't seen it described often, let's change that! www.asfaload.com/blog/rust-tr...

100th github pull request created today at github.com/asfaload/asf... and 697 commits already.

🎉 First time I could go through the whole chain: - register multisig from a github project - activate it by signing it - register a release - sign it - download a release artifact and authenticate it github.com/asfaload/asf... #buildinpublic #progress #rust

After mentioning asfaload in the question time of the #security #talk of @oej.edvina.net at #fosdem, there was some interest to get more info. But while posting the link to the room's #matrix channel, the speaker disappeared! I hope we can talk further later!

With asfaload.com of course! At the #security #talk of @oej.edvina.net at #fosdem

Promoting open source project asfaload.com at #fosdem.org

Just discovered this talk fosdem.org/2026/schedul... at #fosdem by @oej.edvina.net . This is exactly the need that asfaload aims to fill! Looking forward to having a chat!

No asfaload talk at #fosdem this year, but I prepared the design of an A4 flyer, see blog post asfaload.com/blog/fosdem2... And image here: asfaload.com/blog/fosdem2... #buildinpublic #promo #flyer #foss

Added the project to deepwiki at deepwiki.com/asfaload/asf... This generates #documentation that seems quite good! I will probably link it as the documentation for the project. #ai #llms #buildinpublic

Just renamed the GitHub project asfaload, to avoid confusion. Project is now at github.com/asfaload/asf... #buildinpublic

Evolution of llms use in the development of asfaload: asfaload.com/blog/ai_use/ #ai #llms

A new release of asfald, our downloader transparently validating chksums! github.com/asfaload/asf... Most important feat: report vulnerability window,i.e. time between publication and mirroring of chksums. During that time an attacker could update file in release undetected. #buildinpublic #release

Starting a new project from scratch in a new language is often a trial and error approach. Such is the case for the implementation of our generic multisig signoff solution in #rustlang As we #buildinpublic, you can follow progress at github.com/asfaload/asf... Only 3 commits at this time ;-)

github.com/joernio/joern is a multi language code analysis tool. Its release checksums are mirrored by Asfaload to increase the security of downloading it. Check how at asfaload.com/asfald/ #codeanalysis #opensource

With its checksums on the Asfaload mirror, Regal github.com/StyraInc/regal , a linter for #policy definitions used by the open policy agent www.openpolicyagent.org/docs, a #cncf graduate project , can be downloaded with additional security, see www.asfaload.com/asfald/

Ever missed Freshmeat? This is for you: get a continuously updated stream of newly published Github releases at www.freshstuff.net And releases whose checksums files are mirrored by Asfaload are marked as such

A new release of @cloudflare.social 's pint, the #prometheus rule #linter has been published at github.com/cloudflare/p..., and its checksums are already available on asfaload's mirror to let you download with increased security. Check how at www.asfaload.com/asfald/ #security

github.com/pdfcpu/pdfcpu is a #pdf processing library in #go that you can download with additional #security using asfald (see www.asfaload.com/asfald/ )

Need to export your Slack data? this tool can help github.com/rusq/slackdump and as it publishes checksums in its release, our checksums mirror increases the security of your downloads, check out how at www.asfaload.com/asfald/ #slack #export #data #tool

Convert your images on the fly to webp thanks to github.com/webp-sh/webp... which can be downloaded with increased safety using asfald, for more info see www.asfaload.com/asfald/ #webp #server #golang

@neovim.io released version 0.11, a significant release available at github.com/neovim/neovi...! With our checksums mirror you can download it with additional security. Check out how at asfaload.com/asfald #neovim

Rancher Labs' GKE and AKS operators can be downloaded with additional security guarantees with asfald, check how here: www.asfaload.com/asfald Their releases are at github.com/rancher/gke-... and github.com/rancher/aks-... #security #k8s #Cloud