Read-only metadata. Apps download directly from upstream publishers; this server does not host package binaries.
Bootstrap repository; the native PM client is not implemented yet. Empty catalogs mean no packages have been validated for that target.
Signed repository index | Detached Ed25519 signature | Public key
The public key must be pinned in the client from a trusted release; fetching a key and signature from the same untrusted server is not authentication.
Metadata expires 2026-11-25T19:57:08Z. Unknown OS/version/architecture combinations must not fall back to a different target.