Two new video #tutorial: Register your repo's signers file in the Asfaload backend: www.asfaload.com/videos/#regi... and Activate your signers file: www.asfaload.com/videos/#sign... #security #foss #howto

A new tutorial #video about registering your repo's multisig definition with the Asfaload backend: www.asfaload.com/videos/#regi... #tutorial #howto #security

Finally put an explanation in docs of our trust anchor!We trust that if you publish a multisig definition in a github account,you control it.Similar to verifications @letsencrypt.bsky.social does for validating a domain's control. www.asfaload.com/docs/concept... #security #doc #buildinpublic #foss

A new #tutorial #video : see how to publish you multisig definition to your github repo: www.asfaload.com/videos/#publ... This signers file is the trust anchor of the solution, ensuring signature verification is sound. #buildinpublic #security #howto

Published a first demo of our CLI. Covers generating keypairs and reusing ssh keys (yes, asfaload lets you sign your artifact using ssh keys!).Required some tweaks to find the good settings to keep it readable, but looks ok now!See here: www.asfaload.com/videos/#mana... #obs #kdenlive #buildinpublic

It's been two weeks now that I think "tomorrow I can launch the alpha", and each time I see something important to do first. Today, I realised our backend does not sign its git commits, which really weakens our solution. So I'm working on it now... #buildinpublic #security

Published a small intro #video about Asfaload completely produced with #foss: Marp markdown slides, #obs studio recording, #kdenlive editing, #peertube serving. I have embedded it in the homepage at www.asfaload.com

When I introduce someone to Asfaload's solution, I noticed the discussion often follows the same script. That led me to write it down in a post. Take look if you want to understand what Asfaload does and how: www.asfaload.com/blog/asfaloa... #buildinpublic #security #softwaresupplychain

First marketing material for asfaload! "Self-made"(using an LLM). Not a perfect design, but sufficient for now! #buildinpublic

Deployed client howtos at www.asfaload.com/doc/client-c... . Now with demos recorded with github.com/charmbracele... Here's an example for generating a new keypair: #security #buildinpublic #supplychain

One more #breach that @asfaload.bsky.social prevents: www.neowin.net/news/if-you-... Our #opensource #multisig solution is auditable and can be #selfhosted. Check info at asfaload.com Available very soon! #security #softwaresupplychain #jdownloader @neowindy.bsky.social #buildinpublic

If you downloaded this popular software recently, you might have installed malware

Just a month after hackers used the CPU-Z website to spread malware, another popular app's website has been breached and turned into a malware distribution channel.

neowin.net

Preparing demos of our #cli with vhs from @charm.land And I discovered they use sigstore,an alternative to our solution.I must not forget to send them our recordings,we are so easier to use! (sigstore requires a full paragraph of instructions, asfaload is only one line!) Reach out to learn more!

Deployed backend for the first time,and ran an e2e test script on it successfully.It registered a #github project,registered a release' assets, collected signatures from devs,and made a download of the asset, checking signatures.Happy with the progress! #buildinpublic #security #softwaresupplychain

Asfaload's multi sig detects when account hijackers replace existing artifacts. From my understanding that alone would have helped in the #checkmarx attack. See asfaload.com #security #softwaresupplychain

Asfaload can now use your ed25519 ssh keys to sign artifacts! No additional key to manage for Asfaload.

Not sure it is the right order: our documentation is deployed before our backend is even online :-D www.asfaload.com/doc/ The fastest way to deploy the doc was using rust-lang.github.io/mdBook/ , incidentally a #rustlang project like us. #buildinpublic #mdbook #security #softwaresupplychain

Seeing the Axios #compromise on #npm, and as Asfaload enables the detection of unauthorised publications in case of an account hijack,I feel there must be serious opportunities for the project.Take a look at www.asfaload.com and let me know if you have suggestions! #security #supplychain #opensource

Asfaload project,aiming to provide an auditable multisig file downloads auth,passed 1000 commits: github.com/asfaload/asf... In this LLMs age,it might become an even less interesting metric,but if only for me,it reflects the time and energy I put in the project #buildinpublic #opensource #rustlang

Added a section about #llm usage in the README. The project is not vibe coded, but using llms reponsibly is such a productivity boost! #ai #agents

Trying to make Asfaload both secure and future proof by using sha256 oids in its #git backend. This has a performance cost as we need to shell out to the CLI, the libraries support of sha256 oids being WIP. Hoping we don't need to go back to sha1 oids as converting later would be a disrupting change

As my use of #ai has increased gradually (asfaload.com/blog/ai_use/), I have more #code #review work on my plate. I have just installed tuicr (tuicr.dev) in the #docker image I use for development (github.com/asfaload/age...) , and it looks very helpful to ease review of code generated by an #agent

You have to start somewhere: happy with the 10 ⭐ the project got on GitHub: github.com/asfaload/asf... #buildinpublic #foss #opensource #rustlang

GitHub - asfaload/asfaload: Generic multisig signoff solution

Generic multisig signoff solution. Contribute to asfaload/asfaload development by creating an account on GitHub.

github.com

In the Asfaload codebase, there was a pattern that kept appearing: using #rust enum to wrap trait implementations. It offers great flexibility, clean #code, all with full #typesafety and no dynamic dispatch. I haven't seen it described often, let's change that! www.asfaload.com/blog/rust-tr...

100th github pull request created today at github.com/asfaload/asf... and 697 commits already.

Client lib forge trait by rbauduin · Pull Request #100 · asfaload/asfaload

github.com

🎉 First time I could go through the whole chain: - register multisig from a github project - activate it by signing it - register a release - sign it - download a release artifact and authenticate it github.com/asfaload/asf... #buildinpublic #progress #rust

GitHub - asfaload/asfaload: Generic multisig signoff solution

Generic multisig signoff solution. Contribute to asfaload/asfaload development by creating an account on GitHub.

github.com

After mentioning asfaload in the question time of the #security #talk of @oej.edvina.net at #fosdem, there was some interest to get more info. But while posting the link to the room's #matrix channel, the speaker disappeared! I hope we can talk further later!

With asfaload.com of course! At the #security #talk of @oej.edvina.net at #fosdem

Promoting open source project asfaload.com at #fosdem.org

Just discovered this talk fosdem.org/2026/schedul... at #fosdem by @oej.edvina.net . This is exactly the need that asfaload aims to fill! Looking forward to having a chat!

FOSDEM 2026 - Please sign your artefacts. WITH WHAT?

fosdem.org

No asfaload talk at #fosdem this year, but I prepared the design of an A4 flyer, see blog post asfaload.com/blog/fosdem2... And image here: asfaload.com/blog/fosdem2... #buildinpublic #promo #flyer #foss