Asfaload @asfaload.bsky.social · 07/07/2026Two new video #tutorial: Register your repo's signers file in the Asfaload backend: www.asfaload.com/videos/#regi... and Activate your signers file: www.asfaload.com/videos/#sign... #security #foss #howtoasfaload.com Explanatory — Asfaload 000
Asfaload @asfaload.bsky.social · 06/07/2026A new tutorial #video about registering your repo's multisig definition with the Asfaload backend: www.asfaload.com/videos/#regi... #tutorial #howto #securityasfaload.com Explanatory — Asfaload 000
Asfaload @asfaload.bsky.social · 05/07/2026Finally put an explanation in docs of our trust anchor!We trust that if you publish a multisig definition in a github account,you control it.Similar to verifications @letsencrypt.bsky.social does for validating a domain's control. www.asfaload.com/docs/concept... #security #doc #buildinpublic #fossasfaload.comConcepts - Asfaload Documentation 020
Asfaload @asfaload.bsky.social · 05/07/2026A new #tutorial #video : see how to publish you multisig definition to your github repo: www.asfaload.com/videos/#publ... This signers file is the trust anchor of the solution, ensuring signature verification is sound. #buildinpublic #security #howtoasfaload.com Explanatory — Asfaload 040
Asfaload @asfaload.bsky.social · 29/06/2026Published a first demo of our CLI. Covers generating keypairs and reusing ssh keys (yes, asfaload lets you sign your artifact using ssh keys!).Required some tweaks to find the good settings to keep it readable, but looks ok now!See here: www.asfaload.com/videos/#mana... #obs #kdenlive #buildinpublicasfaload.com Explanatory — Asfaload 031
Asfaload @asfaload.bsky.social · 10/06/2026It's been two weeks now that I think "tomorrow I can launch the alpha", and each time I see something important to do first. Today, I realised our backend does not sign its git commits, which really weakens our solution. So I'm working on it now... #buildinpublic #security 120
Asfaload @asfaload.bsky.social · 05/06/2026Published a small intro #video about Asfaload completely produced with #foss: Marp markdown slides, #obs studio recording, #kdenlive editing, #peertube serving. I have embedded it in the homepage at www.asfaload.comasfaload.com Asfaload: Generalized Multisignature Sign-Off — Asfaload Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes. 011
Asfaload @asfaload.bsky.social · 31/05/2026When I introduce someone to Asfaload's solution, I noticed the discussion often follows the same script. That led me to write it down in a post. Take look if you want to understand what Asfaload does and how: www.asfaload.com/blog/asfaloa... #buildinpublic #security #softwaresupplychainasfaload.com A typical Asfaload introduction — Asfaload 021
Asfaload @asfaload.bsky.social · 30/05/2026First marketing material for asfaload! "Self-made"(using an LLM). Not a perfect design, but sufficient for now! #buildinpublic 041
Asfaload @asfaload.bsky.social · 11/05/2026Deployed client howtos at www.asfaload.com/doc/client-c... . Now with demos recorded with github.com/charmbracele... Here's an example for generating a new keypair: #security #buildinpublic #supplychain 012
Asfaload @asfaload.bsky.social · 08/05/2026One more #breach that @asfaload.bsky.social prevents: www.neowin.net/news/if-you-... Our #opensource #multisig solution is auditable and can be #selfhosted. Check info at asfaload.com Available very soon! #security #softwaresupplychain #jdownloader @neowindy.bsky.social #buildinpublicneowin.netIf you downloaded this popular software recently, you might have installed malwareJust a month after hackers used the CPU-Z website to spread malware, another popular app's website has been breached and turned into a malware distribution channel. 022
Asfaload @asfaload.bsky.social · 07/05/2026Preparing demos of our #cli with vhs from @charm.land And I discovered they use sigstore,an alternative to our solution.I must not forget to send them our recordings,we are so easier to use! (sigstore requires a full paragraph of instructions, asfaload is only one line!) Reach out to learn more! 000
Asfaload @asfaload.bsky.social · 06/05/2026Deployed backend for the first time,and ran an e2e test script on it successfully.It registered a #github project,registered a release' assets, collected signatures from devs,and made a download of the asset, checking signatures.Happy with the progress! #buildinpublic #security #softwaresupplychain 222
Asfaload @asfaload.bsky.social · 23/04/2026Asfaload's multi sig detects when account hijackers replace existing artifacts. From my understanding that alone would have helped in the #checkmarx attack. See asfaload.com #security #softwaresupplychainasfaload.com Asfaload: Generalized Multisignature Sign-Off — Asfaload Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes. 010
Asfaload @asfaload.bsky.social · 18/04/2026Asfaload can now use your ed25519 ssh keys to sign artifacts! No additional key to manage for Asfaload. 001
Asfaload @asfaload.bsky.social · 13/04/2026Not sure it is the right order: our documentation is deployed before our backend is even online :-D www.asfaload.com/doc/ The fastest way to deploy the doc was using rust-lang.github.io/mdBook/ , incidentally a #rustlang project like us. #buildinpublic #mdbook #security #softwaresupplychainasfaload.comIntroduction - Asfaload Documentation 131
Asfaload @asfaload.bsky.social · 31/03/2026Seeing the Axios #compromise on #npm, and as Asfaload enables the detection of unauthorised publications in case of an account hijack,I feel there must be serious opportunities for the project.Take a look at www.asfaload.com and let me know if you have suggestions! #security #supplychain #opensourceasfaload.com Asfaload: Generalized Multisignature Sign-Off — Asfaload Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes. 011
Asfaload @asfaload.bsky.social · 16/03/2026Asfaload project,aiming to provide an auditable multisig file downloads auth,passed 1000 commits: github.com/asfaload/asf... In this LLMs age,it might become an even less interesting metric,but if only for me,it reflects the time and energy I put in the project #buildinpublic #opensource #rustlanggithub.comGitHub - asfaload/asfaload: Generic multisig signoff solutionGeneric multisig signoff solution. Contribute to asfaload/asfaload development by creating an account on GitHub. 021
Asfaload @asfaload.bsky.social · 13/03/2026Added a section about #llm usage in the README. The project is not vibe coded, but using llms reponsibly is such a productivity boost! #ai #agents 001
Asfaload @asfaload.bsky.social · 27/02/2026Trying to make Asfaload both secure and future proof by using sha256 oids in its #git backend. This has a performance cost as we need to shell out to the CLI, the libraries support of sha256 oids being WIP. Hoping we don't need to go back to sha1 oids as converting later would be a disrupting change 000
Asfaload @asfaload.bsky.social · 20/02/2026As my use of #ai has increased gradually (asfaload.com/blog/ai_use/), I have more #code #review work on my plate. I have just installed tuicr (tuicr.dev) in the #docker image I use for development (github.com/asfaload/age...) , and it looks very helpful to ease review of code generated by an #agentasfaload.com Evolution of LLMs use by a programmer — Asfaload 021
Asfaload @asfaload.bsky.social · 16/02/2026You have to start somewhere: happy with the 10 ⭐ the project got on GitHub: github.com/asfaload/asf... #buildinpublic #foss #opensource #rustlanggithub.comGitHub - asfaload/asfaload: Generic multisig signoff solutionGeneric multisig signoff solution. Contribute to asfaload/asfaload development by creating an account on GitHub. 041
Asfaload @asfaload.bsky.social · 09/02/2026In the Asfaload codebase, there was a pattern that kept appearing: using #rust enum to wrap trait implementations. It offers great flexibility, clean #code, all with full #typesafety and no dynamic dispatch. I haven't seen it described often, let's change that! www.asfaload.com/blog/rust-tr...asfaload.com Combining Rust's traits and enums — Asfaload 011
Asfaload @asfaload.bsky.social · 09/02/2026100th github pull request created today at github.com/asfaload/asf... and 697 commits already.github.comClient lib forge trait by rbauduin · Pull Request #100 · asfaload/asfaload 001
Asfaload @asfaload.bsky.social · 03/02/2026🎉 First time I could go through the whole chain: - register multisig from a github project - activate it by signing it - register a release - sign it - download a release artifact and authenticate it github.com/asfaload/asf... #buildinpublic #progress #rustgithub.comGitHub - asfaload/asfaload: Generic multisig signoff solutionGeneric multisig signoff solution. Contribute to asfaload/asfaload development by creating an account on GitHub. 022
Asfaload @asfaload.bsky.social · 31/01/2026After mentioning asfaload in the question time of the #security #talk of @oej.edvina.net at #fosdem, there was some interest to get more info. But while posting the link to the room's #matrix channel, the speaker disappeared! I hope we can talk further later! 010
Asfaload @asfaload.bsky.social · 31/01/2026With asfaload.com of course! At the #security #talk of @oej.edvina.net at #fosdem 021
Asfaload @asfaload.bsky.social · 31/01/2026Promoting open source project asfaload.com at #fosdem.org 010
Asfaload @asfaload.bsky.social · 30/01/2026Just discovered this talk fosdem.org/2026/schedul... at #fosdem by @oej.edvina.net . This is exactly the need that asfaload aims to fill! Looking forward to having a chat!fosdem.orgFOSDEM 2026 - Please sign your artefacts. WITH WHAT? 011
Asfaload @asfaload.bsky.social · 28/01/2026No asfaload talk at #fosdem this year, but I prepared the design of an A4 flyer, see blog post asfaload.com/blog/fosdem2... And image here: asfaload.com/blog/fosdem2... #buildinpublic #promo #flyer #foss 051
Asfaload @asfaload.bsky.social · 25/01/2026Added the project to deepwiki at deepwiki.com/asfaload/asf... This generates #documentation that seems quite good! I will probably link it as the documentation for the project. #ai #llms #buildinpublicdeepwiki.comasfaload/asfaload | DeepWikiThis document introduces Asfaload, a cryptographic signature aggregation system that enforces multi-party approval for file releases. It covers the system's purpose, high-level architecture, and core 010
Asfaload @asfaload.bsky.social · 25/01/2026Just renamed the GitHub project asfaload, to avoid confusion. Project is now at github.com/asfaload/asf... #buildinpublicgithub.comGitHub - asfaload/asfaload: Generic multisig signoff solutionGeneric multisig signoff solution. Contribute to asfaload/asfaload development by creating an account on GitHub. 020
Asfaload @asfaload.bsky.social · 21/01/2026Evolution of llms use in the development of asfaload: asfaload.com/blog/ai_use/ #ai #llmsasfaload.com Evolution of LLMs use by a programmer — Asfaload 000
Asfaload @asfaload.bsky.social · 24/06/2025A new release of asfald, our downloader transparently validating chksums! github.com/asfaload/asf... Most important feat: report vulnerability window,i.e. time between publication and mirroring of chksums. During that time an attacker could update file in release undetected. #buildinpublic #releasegithub.comRelease v0.6.0 · asfaload/asfald0.6.0 (2025-06-24) Features add flag to overwrite existing files (ebb8589) print vulnerability window of index (158048c) print vulnerability window of index (640e316) refuse to overwrite existing ... 041
Asfaload @asfaload.bsky.social · 24/06/2025Starting a new project from scratch in a new language is often a trial and error approach. Such is the case for the implementation of our generic multisig signoff solution in #rustlang As we #buildinpublic, you can follow progress at github.com/asfaload/asf... Only 3 commits at this time ;-)github.comGitHub - asfaload/asfasign: Generic multisig signoff solutionGeneric multisig signoff solution. Contribute to asfaload/asfasign development by creating an account on GitHub. 010
Asfaload @asfaload.bsky.social · 20/06/2025github.com/joernio/joern is a multi language code analysis tool. Its release checksums are mirrored by Asfaload to increase the security of downloading it. Check how at asfaload.com/asfald/ #codeanalysis #opensourcegithub.comGitHub - joernio/joern: Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284HcOpen-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc - joernio/joern 010
Asfaload @asfaload.bsky.social · 11/06/2025Just discovered #buildinpublic, which is what I've done with asfaload.com but without any public :-). It started with the goal to provide authenticated downloads, but became a more general multisig sign-off solution. All developed in the open and under open source licenses (AGPLv3 or MPLv2) 🧵asfaload.com Asfaload: Generalized Multisignature Sign-Off — Asfaload Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes. 330
Asfaload @asfaload.bsky.social · 30/05/2025With its checksums on the Asfaload mirror, Regal github.com/StyraInc/regal , a linter for #policy definitions used by the open policy agent www.openpolicyagent.org/docs, a #cncf graduate project , can be downloaded with additional security, see www.asfaload.com/asfald/github.comGitHub - StyraInc/regal: Regal is a linter and language server for Rego, bringing your policy development experience to the next level!Regal is a linter and language server for Rego, bringing your policy development experience to the next level! - StyraInc/regal 000
Asfaload @asfaload.bsky.social · 19/05/2025Ever missed Freshmeat? This is for you: get a continuously updated stream of newly published Github releases at www.freshstuff.net And releases whose checksums files are mirrored by Asfaload are marked as suchfreshstuff.netFreshstuff - 2025-05-19 000
Asfaload @asfaload.bsky.social · 25/04/2025A new release of @cloudflare.social 's pint, the #prometheus rule #linter has been published at github.com/cloudflare/p..., and its checksums are already available on asfaload's mirror to let you download with increased security. Check how at www.asfaload.com/asfald/ #securitygithub.comRelease v0.73.3 · cloudflare/pintFixed Fixed incorrect value in This pint run would create N comment(s), which is more than the limit ... comments when using GitHub or GitLab with pint ci command. 000
Asfaload @asfaload.bsky.social · 23/04/2025github.com/pdfcpu/pdfcpu is a #pdf processing library in #go that you can download with additional #security using asfald (see www.asfaload.com/asfald/ )github.com 000
Asfaload @asfaload.bsky.social · 11/04/2025Need to export your Slack data? this tool can help github.com/rusq/slackdump and as it publishes checksums in its release, our checksums mirror increases the security of your downloads, check out how at www.asfaload.com/asfald/ #slack #export #data #toolgithub.comGitHub - rusq/slackdump: Save or export your private and public Slack messages, threads, files, and users locally without admin privileges.Save or export your private and public Slack messages, threads, files, and users locally without admin privileges. - rusq/slackdump 000
Asfaload @asfaload.bsky.social · 04/04/2025Convert your images on the fly to webp thanks to github.com/webp-sh/webp... which can be downloaded with increased safety using asfald, for more info see www.asfaload.com/asfald/ #webp #server #golanggithub.comGitHub - webp-sh/webp_server_go: Go version of WebP Server. A tool that will serve your JPG/PNG/BMP/SVGs as WebP/AVIF format with compression, on-the-fly.Go version of WebP Server. A tool that will serve your JPG/PNG/BMP/SVGs as WebP/AVIF format with compression, on-the-fly. - webp-sh/webp_server_go 001
Asfaload @asfaload.bsky.social · 28/03/2025@neovim.io released version 0.11, a significant release available at github.com/neovim/neovi...! With our checksums mirror you can download it with additional security. Check out how at asfaload.com/asfald #neovimgithub.com 000
Asfaload @asfaload.bsky.social · 21/03/2025Rancher Labs' GKE and AKS operators can be downloaded with additional security guarantees with asfald, check how here: www.asfaload.com/asfald Their releases are at github.com/rancher/gke-... and github.com/rancher/aks-... #security #k8s #Cloudasfaload.com What is asfald? — Asfaload 000
Asfaload @asfaload.bsky.social · 14/03/2025Today's project discovery: github.com/EricCrosson/... Group your commits by issue into Github PRs. Lets you work on one branch and push to distinct PRs afterwards. Check how to download it with additional safety at www.asfaload.com/asfald/ #github #git #softwaredevelopmentgithub.comGitHub - EricCrosson/git-disjoint: Group commits by issue into GitHub PRsGroup commits by issue into GitHub PRs. Contribute to EricCrosson/git-disjoint development by creating an account on GitHub. 000
Asfaload @asfaload.bsky.social · 07/03/2025#terraform providers are often published with checksums. That's also the case of the huawei cloud provider: github.com/huaweicloud/... See how you can download it with automatic checksums validation at asfaload.com/asfaldgithub.comRelease v1.73.1 · huaweicloud/terraform-provider-huaweicloud 000
Asfaload @asfaload.bsky.social · 28/02/2025Friday project discovery: Permify (github.com/Permify/perm...) is an open source authorization as a service inspired by Google Zanzibar, and as they publish checksums, it can be downloaded with additional safety with asfald: www.asfaload.com/asfald/ #security #authorizationgithub.comGitHub - Permify/permify: An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application.An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. - Permify/permify 010
Asfaload @asfaload.bsky.social · 27/02/2025The copies on our mirror of checksums are now taken much more rapidly. This reduces even more the attack window (eg replacing a file and its checksums file). For example the checksums of this pulumi release were taken less than 3 mins after release: github.com/asfaload/che...github.comGithub://pulumi/pulumi · asfaload/checksums@3aba2bf 000
Asfaload @asfaload.bsky.social · 21/02/2025We had a breakthrough in our search of a satisfying procedure to handle lost and compromised keys, as well as account reinitialisation. All possible without having to trust. Will formalise all this, looking forward to have it implemented! #security #multisig #signature #softwaresupplychain 000
