Select
The workflow selects the latest non-draft, non-prerelease artifact under each product’s namespaced release series.
Distribution and trust
One signed source for independently versioned applications.
The Elixpo package repository publishes the latest stable release of every registered Linux application through a single APT index. The catalogue and repository are assembled atomically so installation guidance cannot silently move ahead of the available artifacts.
Verify
Published SHA-256 checksums, Debian package identity, expected file count, and package versions are checked before indexing.
Sign
APT metadata is rebuilt and the release is signed. Installers verify the expected public key before configuring the source.
Publish
Pages, installers, signing material, package indexes, and immutable package artifacts are deployed as one output.
Public endpoints
Materials clients rely on.
Operational boundary
Website hosting does not replace release authority.
GitHub Releases remain the authoritative store for versioned Debian artifacts and checksums. Cloudflare Pages publishes the assembled catalogue and APT repository, while the package source and build definitions remain in GitHub.
Signing credentials are organization-managed and exposed only to the deployment workflow. Private signing material is never included in the published output.