nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

security: harden registry trust and ingestion
All checks were successful
Standalone registry checks / check (push) Successful in 3m47s
Details

Browse source
This commit is contained in:
Nic Weyand 2026-09-13 02:31:51 -04:00
commit 9705b01fe4
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
25 changed files with 846 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/TRUST.md
View file

@ -18,9 +18,11 @@ writer retains their exact decision/signature bytes in the append-only review lo
Generations bind the database, license document and attribution to a completion
receipt. Consumers provide a trusted hash or verify an external publisher key.
Release signing re-verifies every stored decision against an external reviewer
trust file. Activation checks publisher signatures, rejects structurally incomplete
review proofs and refuses rollback that loses distributed revocations. Updates
build candidates and cannot approve, sign or activate them.
trust file. Activation checks publisher signatures, re-verifies every review
against a separately supplied reviewer trust file and refuses rollback that loses
distributed revocations. Reviewer validity epochs are evaluated at decision time
for retained history while new decisions must pass the trust policy at append
time. Updates build candidates and cannot approve, sign or activate them.
## What a publisher must establish
@ -47,8 +49,11 @@ enforced quorum.
## What consumers must preserve
Authenticate a release before opening it. Keep the full receipt pin and required
attribution with caches and exports. Use `resolve` for reviewed destinations, keep
Authenticate a release before opening it. Consumers that rely on reviewer
separation must use `release::verify_signed` or `activate` with independently
distributed publisher and reviewer trust files; a receipt pin alone delegates the
whole release decision to whoever distributed that pin. Keep the full receipt pin
and required attribution with caches and exports. Use `resolve` for reviewed destinations, keep
null as abstention, and enforce application-specific malware/content/navigation
policy separately. A verified signature authenticates the publisher, not the truth
of every assertion. An official website may later be compromised.