Release binaries for the phpboyscout open source projects, kept here permanently.
Once a file is published here, it is never changed and never removed.
Not on a retention schedule, not to reclaim space, not when a project is archived or a company loses interest. If a release linked to a file in 2026, that link still resolves — to exactly the bytes it resolved to then.
A binary host, and nothing else. Every file here is a compiled artefact, an archive, a checksum or a signature. There is no documentation, no changelog and no directory listing — asking for a folder gets you a 404, deliberately.
These projects previously published to a package registry whose only lifecycle control was deletion, inside a quota we did not set. That is the wrong footing for software other people depend on, so the bytes moved somewhere permanence is the point.
go/forge is served from /go/forge/, mirroring its source path exactly.So, in practice:
https://pkg.phpboyscout.uk/go-tool-base/v0.43.0/gtb_Darwin_arm64.tar.gz https://pkg.phpboyscout.uk/go/forge/v0.30.0/checksums.txt https://pkg.phpboyscout.uk/ffmpeg-wasi/n9.0.1-6/ffmpeg-wasi-driver-linux-amd64-full-gpl.gz
To discover what exists, use the project's releases page on GitLab. This host answers for files you already know the name of; it cannot enumerate them.
Every release publishes a checksums.txt covering its artefacts, alongside a signature over that file.
# the artefact, and the checksums covering it curl -LO https://pkg.phpboyscout.uk/go-tool-base/v0.43.0/gtb_Linux_x86_64.tar.gz curl -LO https://pkg.phpboyscout.uk/go-tool-base/v0.43.0/checksums.txt # verify sha256sum --check --ignore-missing checksums.txt
A checksum covers a file's contents rather than its location, which is what made moving these bytes here safe: a signature made at release time still verifies, whatever URL served the file.
By making it difficult to break rather than by asking nicely, and by checking rather than assuming.
A release pipeline refuses to publish a tag that is already published. Correcting a broken release means cutting a new tag; there is no path through the tooling that replaces bytes somebody has already downloaded and checksummed.
Every published file is fetched back and re-checked against its own checksums.txt, on a schedule. Not a spot check: the whole store, and anything missing or altered raises an alarm the same day. The promise above is worth what its evidence is worth, so the evidence is collected whether or not anybody expects a problem.