nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

security: harden registry trust and ingestion
All checks were successful
Standalone registry checks / check (push) Successful in 3m47s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 02:31:51 -04:00
commit 9705b01fe4
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
25 changed files with 846 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

13
CHANGELOG.md
View file

@ -1,5 +1,18 @@
# Changelog
## 0.3.0 - 2026-09-13
- Snapshot authenticated SQLite bytes into a private file before queries and sign
sealed receipt bytes, removing mutable-path time-of-check/time-of-use windows.
- Require consumer-supplied reviewer trust roots during signed verification and
activation; support retired reviewer keys with OpenSSH validity epochs.
- Hash the exact source descriptor stream consumed by parsers and add configurable
expanded-byte, record, database-growth, query-output and diff-output limits.
- Bind identity decisions to entity metadata, redact descriptions from typed diffs,
include diff attribution and keep CrUX job IDs stable across output-only limits.
- Migrate writer stores to schema/rules version 3 while allowing activation over
pinned version 1 and version 2 generations for revocation checks.
## 0.2.0 - 2026-09-13
- Open generations from an authenticated immutable SQLite file descriptor and