Fimeg
e2dab2845a
supply-chain: gate our own deps, ship the verdict signed ...
dep-scan.sh gates go/npm/cargo on push and bakes an attested posture into the
release — embedded in the server, signed into the manifest. Reasoning and the
two Moby exceptions are in SECURITY.md.
(posture-builder runs rustup; bookworm's cargo is too old for cargo-audit.)
2026-06-14 11:43:23 -04:00
feat: component manifest drives installs, checkoff, and desktop lockstep
2026-06-12 15:23:15 -04:00
supply-chain: gate our own deps, ship the verdict signed
2026-06-14 11:43:23 -04:00
feat(security): A-1 Ed25519 key rotation + A-2 replay attack fixes
2026-03-28 21:25:47 -04:00
supply-chain: gate our own deps, ship the verdict signed
2026-06-14 11:43:23 -04:00
feat: standalone local authority — helper mint mode + local approval flow
2026-06-10 09:04:06 -04:00
ci: Gitea Actions pipeline — release gate, embedded UI build, guided release script
2026-06-11 02:01:42 -04:00
ci: Gitea Actions pipeline — release gate, embedded UI build, guided release script
2026-06-11 02:01:42 -04:00
e2dab2845a