e2dab2845a
dep-scan.sh gates go/npm/cargo on push and bakes an attested posture into the release — embedded in the server, signed into the manifest. Reasoning and the two Moby exceptions are in SECURITY.md. (posture-builder runs rustup; bookworm's cargo is too old for cargo-audit.)
7 lines
99 B
JSON
7 lines
99 B
JSON
{
|
|
"attested": false,
|
|
"generated_at": 0,
|
|
"substrate": {},
|
|
"scans": [],
|
|
"exceptions": []
|
|
}
|