Every package on OLO Orgs is checked and then signed with an Ed25519 key that only the internal package checker holds. The signature covers the package id, version, package digest, descriptor digest, archive hash and the publisher slug, plus the marketplace id below.
ToolGate verifies the signature with a key you pin in its configuration before it imports anything, so a change to this website or its storage cannot make ToolGate install altered bytes.
Signing is not a code review. It says where a package came from, not that it is safe. Review a tool before you deploy it.
Marketplace id
olo-labs-marketplace
Keys
| Key id | Status | Fingerprint | Public key |
|---|---|---|---|
olo-demo-marketplace-1 | current | sha256:0accb3590d230a21882d58cfcf8419f11c09b01b7461554d00b912bba644b97c | uaeyUMtzY82j1j2tgLypvXvsZlRf2pnDZXJTFqwp0r4= |
Set this in ToolGate Control, and check the fingerprint against this page from more than one network:
TOOLGATE_CONTROL_MARKETPLACE_ID=olo-labs-marketplace
TOOLGATE_CONTROL_MARKETPLACE_KEYS=olo-demo-marketplace-1:uaeyUMtzY82j1j2tgLypvXvsZlRf2pnDZXJTFqwp0r4=