[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H0D04EERSP6VEDFDYFPYYF":3,"skill-same:01M6H0D04EERSP6VEDFDYFPYYF":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":48,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M6H0D04EERSP6VEDFDYFPYYF","sign-release-binaries",null,"Use when publishing binaries whose origin a user must be able to prove. Produces detached signatures with a keyless or managed key and documents how to verify them.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-sign-release-binaries\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-sign-release-binaries\u002FSKILL.md",[],[20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"release","sign release binaries","sign","when","documents","prove","managed","with","how to","origin","signatures","publishing","use","user","how","verify","keyless","2026-11-10 10:12:30",false,"---\nname: sign-release-binaries\ndescription: Use when publishing binaries whose origin a user must be able to prove. Produces detached signatures with a keyless or managed key and documents how to verify them.\n---\n\n# Sign Release Binaries\n\nUnsigned releases are indistinguishable from a malicious mirror's copy. A signature with a published identity and a documented verification command turns trust into a check.\n\n## Procedure\n\n1. Decide the mode. Keyless (Sigstore\u002FOIDC) ties the signature to a CI workflow identity and needs no stored secret; a managed key (KMS, `gpg`) suits air-gapped or non-CI releases.\n2. Keyless in GitHub Actions — give the job `id-token: write` and sign the built artifacts:\n   `cosign sign-blob --bundle dist\u002Fapp.sigstore dist\u002Fapp`\n3. Detached GPG for key-managed releases. Use a dedicated release key, not a personal one:\n   `gpg --armor --detach-sign --local-user releases@example.org dist\u002Fapp`\n   Export the public key once per major version: `gpg --armor --export releases@example.org > release-key.asc`.\n4. Sign containers by digest, not tag: `cosign sign registry\u002Fapp@sha256:\u003Cdigest>`.\n5. Sign the checksum file too, so a user can verify many artifacts from one trusted root:\n   `sha256sum dist\u002F* > SHA256SUMS && cosign sign-blob --bundle SHA256SUMS.sigstore SHA256SUMS`.\n6. Publish signatures next to the artifacts, plus a short `VERIFY.md` with the exact command and the expected certificate identity or key fingerprint.\n7. Store any long-lived signing key encrypted (age\u002FGPG) and available only to the release job; never commit it.\n\n## Pitfalls\n\n- Signing before the artifact is final (still gets a timestamp or repack) invalidates the signature; sign the exact bytes you ship.\n- Re-signing an artifact with a new key after a compromise does not un-publish the old signature — revoke the key and tell users.\n- A signature proves integrity and identity, not safety; pair it with provenance and an SBOM.\n- Keyless signatures embed a short certificate lifetime; verification depends on the Rekor transparency log, so do not delete the bundle.\n- Committing a passphrase-free private key to CI secrets is a leak waiting to happen; scope the token to the release environment.\n\n## Verification\n\n    cosign verify-blob --bundle dist\u002Fapp.sigstore \\\n      --certificate-identity-regexp '^https:\u002F\u002Fgithub.com\u002Forg\u002Frepo\u002F' \\\n      --certificate-oidc-issuer https:\u002F\u002Ftoken.actions.githubusercontent.com dist\u002Fapp\n\nFor GPG: `gpg --verify dist\u002Fapp.asc dist\u002Fapp` prints `Good signature from releases@example.org`. Both must pass with the documented identity.\n\nReport: \"Signed \u003Cartifacts> keyless from \u003Cworkflow>; verification command in VERIFY.md returns Verified OK for identity \u003Cregexp>.\"\n","# Sign Release Binaries\n\nUnsigned releases are indistinguishable from a malicious mirror's copy. A signature with a published identity and a documented verification command turns trust into a check.\n\n## Procedure\n\n1. Decide the mode. Keyless (Sigstore\u002FOIDC) ties the signature to a CI workflow identity and needs no stored secret; a managed key (KMS, `gpg`) suits air-gapped or non-CI releases.\n2. Keyless in GitHub Actions — give the job `id-token: write` and sign the built artifacts:\n   `cosign sign-blob --bundle dist\u002Fapp.sigstore dist\u002Fapp`\n3. Detached GPG for key-managed releases. Use a dedicated release key, not a personal one:\n   `gpg --armor --detach-sign --local-user releases@example.org dist\u002Fapp`\n   Export the public key once per major version: `gpg --armor --export releases@example.org > release-key.asc`.\n4. Sign containers by digest, not tag: `cosign sign registry\u002Fapp@sha256:\u003Cdigest>`.\n5. Sign the checksum file too, so a user can verify many artifacts from one trusted root:\n   `sha256sum dist\u002F* > SHA256SUMS && cosign sign-blob --bundle SHA256SUMS.sigstore SHA256SUMS`.\n6. Publish signatures next to the artifacts, plus a short `VERIFY.md` with the exact command and the expected certificate identity or key fingerprint.\n7. Store any long-lived signing key encrypted (age\u002FGPG) and available only to the release job; never commit it.\n\n## Pitfalls\n\n- Signing before the artifact is final (still gets a timestamp or repack) invalidates the signature; sign the exact bytes you ship.\n- Re-signing an artifact with a new key after a compromise does not un-publish the old signature — revoke the key and tell users.\n- A signature proves integrity and identity, not safety; pair it with provenance and an SBOM.\n- Keyless signatures embed a short certificate lifetime; verification depends on the Rekor transparency log, so do not delete the bundle.\n- Committing a passphrase-free private key to CI secrets is a leak waiting to happen; scope the token to the release environment.\n\n## Verification\n\n    cosign verify-blob --bundle dist\u002Fapp.sigstore \\\n      --certificate-identity-regexp '^https:\u002F\u002Fgithub.com\u002Forg\u002Frepo\u002F' \\\n      --certificate-oidc-issuer https:\u002F\u002Ftoken.actions.githubusercontent.com dist\u002Fapp\n\nFor GPG: `gpg --verify dist\u002Fapp.asc dist\u002Fapp` prints `Good signature from releases@example.org`. Both must pass with the documented identity.\n\nReport: \"Signed \u003Cartifacts> keyless from \u003Cworkflow>; verification command in VERIFY.md returns Verified OK for identity \u003Cregexp>.\"\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-sign-release-binaries",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-12 02:28:42",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill sign-release-binaries",{"tool":57,"command":58},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill sign-release-binaries",{"tool":60,"command":61},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill sign-release-binaries","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-sign-release-binaries\u002FSKILL.md",true,[65,69,75],{"path":66,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"SOURCE.md","REFERENCE","参考文档",347,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-sign-release-binaries\u002FSOURCE.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"TRUST.auto.yaml",2196,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-sign-release-binaries\u002FTRUST.auto.yaml",[80,108,131,149,162,172],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":84,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":37},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":113,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":37},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[117,118,119,120,121,122,123,124,125,126,127,128,129,130],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":135,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":37},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[139,118,140,141,142,143,144,128,127,126,145,146,147,122,148,121,120],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":153,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":37},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[157,158,119,159,160,129,127,161,125,124,122,121],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":163,"name":164,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":165,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":37},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[169,170,171],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":176,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":37},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[180,181,182,35,183,184,185,32,186,187,188],"tests","cover","verify tests cover changed lines","coverage","pr","exercise","patch","code","share"]