Sentinel source

Read the agent before you run it

Sentinel runs inside your network and reads your certificates. Its complete source is published under the Apache-2.0 license, as a signed archive you can download, verify, and rebuild without an account.

Current release

Download source archive Detached signature (.asc)

The archive tracks the current release. Verify it before you read or build it.

Step 1 · Verify

Check the signature before you trust the archive

The archive is signed with the same key that signs the Nocert APT repository. A download that does not verify is not a Nocert release.

Signing key fingerprint

D5EF CB2E 291B 386D 5161 8CB3 E1DF FDD9 DF7B BB21

The Primary key fingerprint line printed by gpg --verify must match this value exactly. If it does not, stop and tell us.

This fingerprint is published here, on a different host from the repository, so that a compromise of repo.nocert.io cannot also supply the key you check against.

curl -fsSL -O https://repo.nocert.io/src/nocert-sentinel-src.tar.gz
curl -fsSL -O https://repo.nocert.io/src/nocert-sentinel-src.tar.gz.asc
curl -fsSL https://repo.nocert.io/apt/gpg.key | gpg --import

gpg --verify nocert-sentinel-src.tar.gz.asc nocert-sentinel-src.tar.gz

Step 2 · Reproduce

Rebuild the exact binary we ship

The build is reproducible: compiling this archive produces a binary byte-for-byte identical to the one inside the published .deb. Matching SHA-256 sums show that the published source builds to the binary in the published package; you can separately compare that package binary with the executable you deploy.

Dependencies are vendored, so the build needs a Go toolchain and nothing else. No network access, no module proxy.

tar xzf nocert-sentinel-src.tar.gz
cd nocert-sentinel-<version>

# README.md contains the exact build command and Go toolchain.
sha256sum nocert-sentinel

# Compare with the binary shipped in the package.
dpkg-deb -x nocert-sentinel_<version>_linux_amd64.deb pkg
sha256sum pkg/usr/bin/nocert-sentinel

Contents

What is in the archive

Every dependency is vendored, and the agent's own tests are part of the published source.

cmd/ and internal/: The agent itself, with its unit tests.
vendor/: Every dependency, source included, so the build needs no network access and no module proxy.
THIRD_PARTY_NOTICES and LICENSE: License texts of the components linked into the binary, and the Apache-2.0 license of Sentinel itself.
README.md: The verification step and the exact build command that reproduces the shipped binary.

Scope

What this archive is, and what it is not

This is the agent, not the platform. The Nocert backend, the web application, and the certificate parser are proprietary and are not published. What is open is the component that runs on your infrastructure and reads your certificates.

Sentinel is not hosted on a public code-forge account, and there is no public issue tracker or pull-request workflow. The signed archive above is the distribution channel. Send findings and questions through the contact page, or use the RFC 9116 details in security.txt for vulnerability reports.

Install channel

The packages are signed by the same key

Sentinel installs from a Debian and Ubuntu APT repository at repo.nocert.io, signed by the key above. The Security page describes what the agent sends, what it never sends, and how it authenticates to Nocert.

Read the security model