state packages come from github only

2026-09-01 11:48:40 +02:00
parent 32094c5541
commit 691736a62c
6 changed files with 15 additions and 7 deletions
@@ -28,7 +28,7 @@

            <h3>Verified fetch</h3>
            <ul class="features">
-                <li><strong>Mirror then upstream.</strong> Downloads prefer the project mirror and fall back to upstream, never the other way.</li>
+                <li><strong>Mirror then upstream.</strong> Downloads try <code>SOURCE_MIRROR</code> when set and fall back to upstream. Unset — the default — they go straight to upstream.</li>
                <li><strong>Integrity enforced.</strong> A fetched tarball that doesn't verify is refused, not untarred. Failed verification is a hard stop.</li>
                <li><strong>Pinned sources.</strong> Recipes pin the exact <code>url</code> and version. Nothing is ever pulled "latest" implicitly.</li>
            </ul>
@@ -49,7 +49,7 @@ kama-packages/*.sh      # recipes as plain shell you can read top to bottom</div
            <h3>Licensing, because supply chain is security</h3>
            <p>All three repos are <span class="tag accent">AGPL-3.0</span>. Recipes tag their <code>license</code> explicitly. Nothing in the pipeline is proprietary-black-boxed.</p>

-            <div class="callout">Trust is transitive: you still trust the sources you install and the mirror that serves them. Keru's job is to make that trust chain visible and verifiable — not to pretend you can be protected from everything.</div>
+            <div class="callout">Trust is transitive: you still trust the sources you install and any mirror you point at. Keru's job is to make that trust chain visible and verifiable — not to pretend you can be protected from everything.</div>

            <h3>Reporting</h3>
            <p>Found a flaw in the installer, kama, or a recipe? File it with the stage and the failing artifact. See <a href="contact.html">contact</a> and <a href="troubleshooting.html">troubleshooting</a>.</p>