crossfyre 0.1.33

crossfyre 0.1.33 for Linux on x86_64 and aarch64: the first-party build of the Crossfyre CLI that https://get.crossfyre.io/install.sh and the apt repository install. The packages here, and SHA256SUMS with its two signatures, are the files https://bins.crossfyre.io/crossfyre/index.html#v0.1.33 lists, byte for byte.

The open build, compiled by GitHub Actions from the public source, is on the releases page of clickswave/crossfyre-toolchain.

Versions

When this release was published, https://bins.crossfyre.io/manifest.json listed these versions. crossfyre fetches the others from the same server when it installs or updates them.

Component	Version
crossfyre	0.1.33
node	0.1.43
ambulo	0.0.17
voyage	0.0.10
doorward	0.0.10
toolmark	0.0.9
plessor	0.0.25
cfx-script	0.1.2

Source

The open source code in these binaries is clickswave/crossfyre-toolchain at commit 5c61c0ffd85d. They also hold the first-party parts the open build leaves out, so building that commit gives the open build, not these files.

Verify

Put SHA256SUMS, SHA256SUMS.sig and SHA256SUMS.asc in one directory with the packages you downloaded. SHA256SUMS gives the sha256 of each package:

sha256sum --ignore-missing -c SHA256SUMS

SHA256SUMS.sig is an Ed25519 signature over SHA256SUMS by the release key, which https://get.crossfyre.io/install.sh also carries. Checking it takes OpenSSL 3.0 or later:

printf -- '-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA%s\n-----END PUBLIC KEY-----\n' 'kbMTWSxOuXPz8Wu8MMf552R66V5GivbTChZeyyoT3Sk=' > crossfyre-release.pem
base64 -d SHA256SUMS.sig > SHA256SUMS.sig.bin
openssl pkeyutl -verify -pubin -inkey crossfyre-release.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig.bin

SHA256SUMS.asc is an OpenPGP signature over SHA256SUMS by the archive key that signs the apt repository, whose primary key is 992F 106C 6CF0 32E4 3A3C A8BE D5D9 2DAC 3BA8 CDBF:

curl -fsSLO https://bins.crossfyre.io/apt/crossfyre-archive-keyring.gpg
gpg --show-keys crossfyre-archive-keyring.gpg
gpgv --keyring ./crossfyre-archive-keyring.gpg SHA256SUMS.asc SHA256SUMS

Licence

The binaries are published under BINARY-LICENCE.txt, which is attached here and comes with each package. The source code in clickswave/crossfyre-toolchain is under the Apache License 2.0, which each package also carries. THIRD-PARTY-NOTICES lists the open source components compiled into the binaries, with their licences.