Host key fingerprints
ssh-keyscan -t ed25519,rsa sftp.repoforge.io | ssh-keygen -lf -Run this and compare its output with the fingerprints below. If they match, you're talking to RepoForge.io.
The first time you connect to an SFTP server, your client shows the server's host key fingerprint and asks whether to trust it. Checking it against this page is what stops someone else on the network from pretending to be the server and collecting your password or files. After that, your client remembers the key and warns you if it ever changes.
Fingerprints
sftp.repoforge.io has two host keys. Your client shows whichever one it prefers, usually ED25519.
| Key | SHA256 fingerprint | MD5 fingerprint |
|---|---|---|
| ED25519 | SHA256:pT5DQ3Y3w3iPX7eUeExHIaFePbNDWNBMp/XYFbrbHTg | MD5:5a:d2:17:e2:b3:e0:01:89:02:76:6a:63:7e:76:df:17 |
| RSA | SHA256:q4Nn7ziCb8YmdyET4a/6X2953d+xabhOX8xzFF1sn78 | MD5:63:99:cf:aa:e2:5e:97:d7:cb:7d:64:e5:68:51:c0:a9 |
Most clients show the SHA256 form. Some older clients show the MD5 form.
These fingerprints are read from the live server every time this site is published, rather than typed in by hand.
Adding the keys to known_hosts
For scripts and CI jobs, add the keys to your known_hosts file before connecting, so the connection is checked from the very first run instead of trusting whatever key is presented. Append these lines to ~/.ssh/known_hosts (or store them in your CI system, as in the GitHub Actions example):
sftp.repoforge.io ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENsx9YWu08WudnDPaxEXnGY7/Ng8mXRw1P4MgdxAKX/
sftp.repoforge.io ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6ruTKP2HUOOa6ykRJmPutQlmlGDicBLZv+yHyHHBIzA8YoXp5TLvT9I/958UGtGl4aMYzcx/mcpVb2S2ErCZJeipCygC+udAhAw/yEjIaan2aHkgZii70wrcKFm5YfkZ0YaUpg3IP/A7g+RWAI1mN/J91py5lH4dsHhJDt6Rpqf1vFHrE2vz6654hMxxDMgw6elx9GvYWGrjssVhoBb7IJKfAA816fy3RJ0mmIl/aj5IWG82xvYkLK2h5ujPNnTv//O7ZqaL1hxmUkC5srsxpD1C2r+mgQWHo+7UavpzPE1rLhYZu6rutdJvN5FU2zrzjTgyJkYRP9UJrnBAkE9XVfhSXubrrrcO1K4i6cuEUg2758+jby/2+UFm5EhM8rmx5jpuBwcoAHy2DxlD/989Ot9E1QL4mzclmUsIC5husYlClIYGvxX4z9j0sP3cqeS/TN376fvPA6EVTBBzJof7naMJftacjUvdNC/MGag3SevAe5jf9XLn/syxSPsPeAO5eN8oNzm5wYyJkFZQ3Q9vOqm04JEtzJ3XOPRDMlBOH7eHDj6hKf+k0xDa5OiiXPDtE0qRyjoi/zoVpeECQd1aAmYZiae0Ud7kMQHKX5FBID12IwaoWPZ/aM59VCbNDm0euovSnbZqCiK9obDaS1i9Uge3ADgEXakf0d34NX32Grw==You can also fetch them yourself and check the fingerprints match the table above before saving them:
ssh-keyscan -t ed25519,rsa sftp.repoforge.io > repoforge_sftp_known_hosts
ssh-keygen -lf repoforge_sftp_known_hosts
cat repoforge_sftp_known_hosts >> ~/.ssh/known_hostsRotation policy
We don't rotate these host keys. Clients remember them, so a change would make every client refuse to connect. If a key ever has to change, we'll give notice in advance and publish the new fingerprints on this page before it happens.
If your client warns that the host key has changed and there's been no such notice, don't connect. Contact support@repoforge.io.