The repository *qubes-secpack* centralises all Qubes OS security‑related artifacts—including PGP signing keys, security bulletins, canaries, fund information, and ISO digests—so they can be cryptographically verified via signed commits and detached signatures. It is intended for Qubes users, developers, auditors, and anyone who wants to independently validate authentic security releases and announcements from the Qubes OS project.