Check against your doze

FerretDB

OfficialSigned

MongoDB-compatible database (FerretDB v2 over Postgres)

doze/ferret

$ doze add ferret

Newest: 0.2.3 · 2 Nov 2026
Needs: any doze
Runs: FerretDB 2
Platforms: macOS arm64 · Linux arm64 · Linux x86_64
Licence: Apache-2.0
Source: on GitHub

ferret 0.2.3

Current

Release

Released: 2 Nov 2026
Needs: any doze
Plugin protocol: 1
Engines: FerretDB 2
Platforms: 3 of 3
Advisories: None known

0.2.3 sets no oldest doze, so it runs on every doze (0.1.0 and up).

Release notes

View on GitHub

No notes for this release.

Since 0.2.2 (3 Jul 2026). Upgrading from an older release: doze modules upgrade ferret. Your engine pins and data stay as they are.

Artifacts

One signed archive per platform. Files live on GitHub; the registry lists them and signs their checksums.

Platform	File (downloads from GitHub)	SHA-256	Signature (ed25519)
macOS arm64 aarch64-apple-darwin	ferret-plugin-0.2.3-aarch64-apple-darwin.tar.gz	`c658434a1d781d2f3b81d8fe114cad6ac1943a324b5bd2b09e63ec8544c9d37c`	`Ssu96MaN…6RAg==`
Linux arm64 aarch64-unknown-linux-gnu	ferret-plugin-0.2.3-aarch64-unknown-linux-gnu.tar.gz	`d7c189497583a23859b74d6eefdddd2a231dfff459ff874b03fb65a47dabcb1e`	`IdNtoDBy…oOCA==`
Linux x86_64 x86_64-unknown-linux-gnu	ferret-plugin-0.2.3-x86_64-unknown-linux-gnu.tar.gz	`40de4c1878177a21ad67a682387b1d142bceaa3eb47c9d83f98e1d4a65cfb363`	`ROaCxU1w…U/Cg==`

Every file is under https://github.com/doze-dev/doze-modules/releases/download/ferret/. Intel Macs and Windows have no build; WSL2 uses the Linux x86_64 file.

Signing

The index is signed as a whole, and each archive is signed. doze checks both before anything runs, and refuses a module whose checksum or signature doesn't match.

Key: Nu5y8mbj…Wjw=
Where the key lives: Compiled into doze. doze never fetches or trusts a key on first use.
Namespace: doze
Publisher: doze-dev Official
Index signature: kpZE+ML2…Dg==
What is signed: Each archive: its lowercase-hex SHA-256. The index: module, namespace, releases and channels as canonical JSON.
Not yet signed: The doze (oldest doze) field sits beside the signed part today. new The design moves it inside.

How signing works

Verify it yourself

[planned: doze modules verify] Today doze runs these checks itself on every download. The same checks by hand, for macOS arm64. Needs OpenSSL 3: the openssl that ships with macOS has no ed25519 (brew install openssl@3).

Checksum, then signature

# 1. download and hash; compare with the table above
$ curl -LO https://github.com/doze-dev/doze-modules/releases/download/ferret/ferret-plugin-0.2.3-aarch64-apple-darwin.tar.gz
$ shasum -a 256 ferret-plugin-0.2.3-aarch64-apple-darwin.tar.gz
c658434a1d781d2f3b81d8fe114cad6ac1943a324b5bd2b09e63ec8544c9d37c  ferret-plugin-0.2.3-aarch64-apple-darwin.tar.gz

# 2. the signature is over that hex string, with doze's public key
$ printf %s c658434a1d781d2f3b81d8fe114cad6ac1943a324b5bd2b09e63ec8544c9d37c > digest.txt
$ echo 'Ssu96MaN6j1wvEicmkk5uhAS1Z7coQP6aLwZHFcudg4hrIgcnrF2PaGI7L26nxOaYLjHBBzjnOInJDO/7i6RAg==' | base64 -d > sig.bin
$ (printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00'; echo 'Nu5y8mbjYv7XEtNFBXwPVl+C8SBteVApIROefBwGWjw=' | base64 -d) > doze-key.der
$ openssl pkeyutl -verify -pubin -keyform DER -inkey doze-key.der -rawin -in digest.txt -sigfile sig.bin
Signature Verified Successfully

What doze.lock records for 0.2.3

A project pinned to 0.2.3 carries this entry. Every platform's checksum goes in, so a teammate on Linux verifies against the same pin you made on a Mac. Pinned and cached means no network at all.

The engine itself is pinned separately, under engines:. Engine versions

doze.lock

modules:
    doze/ferret:
        version: 0.2.3
        protocol: 1
        engines:
            - "2"
        hashes:
            aarch64-apple-darwin: sha256:c658434a1d781d2f3b81d8fe114cad6ac1943a324b5bd2b09e63ec8544c9d37c
            aarch64-unknown-linux-gnu: sha256:d7c189497583a23859b74d6eefdddd2a231dfff459ff874b03fb65a47dabcb1e
            x86_64-unknown-linux-gnu: sha256:40de4c1878177a21ad67a682387b1d142bceaa3eb47c9d83f98e1d4a65cfb363
        # no doze: line; 0.2.3 sets no oldest doze