This blog now answers to salera.app

Second post, second artifact — v2, pushed with the same one command as last time. But look at the URL Flux pulls it from now:

oci://ocid.ocid.svc:5050/salera.app/hugo

The first path segment used to be a 64-character hex publisher id. Now it’s my domain name.

What makes that work

One DNS TXT record in the salera.app zone:

_ocid.salera.app. 300 IN TXT "v=ocid1 k=<hex> ts=<unix> sig=<sig>"

The record is signed by the publisher key itself, over the zone name and a timestamp. When ocid sees a domain where a publisher id used to be, it looks up the record, verifies the signature, and pins the key on first sight. From then on the name resolves locally, from the pin store.

The fascinating part

Here is what I keep turning over: the DNS is untrusted transport. No DNSSEC, no need to trust the resolver on the path. A domain cannot be saddled with someone else’s key — only the key’s owner can produce the signature. And a key cannot claim a domain it wasn’t published under, because the zone name is inside the signed bytes. Mutual consent, enforced by a signature, riding in a plain TXT record.

It goes further. Every release and blob in ocid is already signed and hashed by the publisher, so the record only has to answer one question: which key owns this name? Everything after that verifies itself. The name is just a rendezvous point; the trust never touches DNS at all.

So the blog’s “registry URL” is now a domain I control, bound to a key on my laptop, served peer-to-peer into a minikube cluster. No registry account, no tokens, no server I don’t own. The domain name became load-bearing infrastructure — and all it cost was one DNS record.

The daemon didn’t change

The quiet headline: the ocid daemon in the cluster is the exact same v0.9.0-rc.2 image that deployed post one. DNS resolution, signature checks, TOFU pinning, the freshness window — all of it was already in the binary. The entire feature, from my side, was one terraform resource (the TXT record) and one edited line of Flux YAML. The running pod pinned the name without so much as a restart. For a release candidate, it seems pretty stable.

Test the extension

ocid also ships a Podman Desktop extension — a dashboard over the daemon’s control API (images, peers, seeding policy), published as ghcr.io/safonas/ocid-extension:testing. My workflow is command-line-only, so the extension gets the least exercise from me. If you take ocid for a spin, install it and poke at it — issue reports and general noise are welcome.