asymptote-labs/agent-beacon is a memory layer that runs across multiple AI agent harnesses. The commit ec24e31 of November 7, 2026 touches the Linux distribution path. v1.3.57 was the first signed release, and this commit documents that fact along with the apt repository (https://apt.beacon.sh), and from the next release onward installation and automatic updates enforce signing.
The core is key pinning. cli/beacon/internal/endpoint/selfupdate/release-key.fingerprint now contains 07BEA34ED6A411F4C066D98322F94195DCDC8F45 (Beacon Linux Release Signing, RSA 4096), and install.sh and beacon endpoint update --apply now do not install Linux packages (.deb, .rpm) unless the checksum list checksums.txt is signed with that key. Signature verification uses gpgv, and environments that have sqv instead of gpgv (Debian trixie based images) are accepted as well. If the same key is missing or a different key is used, the goreleaser job fails. The documentation added publication of the fingerprint, the manual verification procedure, and the apt repository installation method (keyring lookup, fingerprint check, signed-by source, apt install beacon).
The point of change is clear. Releases before v1.3.57 have no signature, so when the next release's install.sh points at that version via BEACON_VERSION it is rejected, and the apt repository starts from 1.3.57. If an older version is needed, you have to follow the install.sh of that release or the manual installation steps. The new tests check that unsigned releases stop at verify release signature before dpkg/rpm runs, and that the fingerprints in the pin, the documentation, and the keyring file match, but the full cli/beacon test suite and apt install on an actual host were not executed (CI does that instead). The enforcement logic is backed by tests, but the real apt installation path was not verified by this change alone.