# Private signing keys. NEVER commit one of these.
# The real key lives only in the INDEX_SIGNING_KEY CI secret.
*.pem
*.key
index-signing-key*

# NOTE: v1/index.json.sig IS committed -- it is the published artifact. The
# index is served from this repo's raw URLs, so the committed signature is what
# hosts fetch, and keeping it in git history makes every past signature
# independently auditable. Only CI (with the real key) should ever write it.
#
# If you sign locally to experiment, write the result somewhere clearly
# disposable so it cannot be mistaken for the real signature and committed:
#   bun run sign -- --key throwaway.pem && mv v1/index.json.sig scratch.sig
*.scratch.sig
scratch.sig

node_modules/
.DS_Store