Skip to content

Releases: Axiumine/c15t

Release list

v0.1.0

v0.1.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Oct 22:47
v0.1.0
10e051b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First release. The project is pre-1.0: minor versions may contain breaking changes.

Added

  • The platform itself: consent-api (one c15t instance per registered site), dashboard-api (Hono and Better
    Auth, admin and read-only user roles), dashboard-web (React single-page app), the shared packages, the
    PostgreSQL layer (app and c15t schemas) and infra/ (nginx, systemd, deploy.sh with rollback).
  • Licensed under AGPL-3.0-or-later, with an SPDX header in every source file and REUSE.toml for the
    rest (scripts/add-spdx-headers.mjs).
  • Community and project-health files: SECURITY.md, CONTRIBUTING.md (DCO sign-off), CODE_OF_CONDUCT.md,
    GOVERNANCE.md, SUPPORT.md, CODEOWNERS, issue and pull-request templates.
  • GitHub Actions: CI (typecheck, lint, unit tests, build, integration tests against PostgreSQL,
    coverage), CodeQL, dependency review, OpenSSF Scorecard, and a release workflow that signs release
    assets with cosign, attaches SLSA provenance and a CycloneDX SBOM.
  • Dependabot configuration for GitHub Actions and npm.
  • Property-based (fuzz) tests with fast-check for the security-sensitive parsing and validation code.
  • Documentation: docs/architecture.md, docs/security-model.md, docs/dependency-policy.md,
    docs/database-setup.md, docs/scorecard.md, docs/openssf-best-practices.md.

Changed

  • The coverage report counts every source file under apps/*/src and packages/*/src. Entry points that no
    test imports (the servers, admin-create, migrate, main.tsx) now show up at 0% instead of being left
    out.
  • README: the getting-started steps begin with git clone.

Fixed

  • Code scanning alerts in scripts and tests: a file-system race in scripts/add-spdx-headers.mjs, biased
    random subject ids in the end-to-end helpers, a script end-tag pattern in an end-to-end spec that
    HTML parsers accept more loosely, an incomplete path sanitization in the route coverage test, and an
    absolute checkout path reaching a shell command in scripts/check-dco.test.mjs.
  • The cursor pagination fuzz test no longer times out on a loaded CI runner.

Verify the assets

Every asset has a keyless cosign signature (<asset>.sigstore.json) and the release has
SLSA provenance (*.intoto.jsonl). The SBOMs are CycloneDX 1.6 (*.cdx.json).

sha256sum --check SHA256SUMS
cosign verify-blob --bundle <asset>.sigstore.json \
  --certificate-identity https://github.com/Axiumine/c15t/.github/workflows/release.yml@refs/tags/v0.1.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com <asset>
slsa-verifier verify-artifact <asset> --provenance-path <provenance>.intoto.jsonl \
  --source-uri github.com/Axiumine/c15t --source-tag v0.1.0

The built tarballs hold compiled output; the platform itself is deployed from the tagged
source with infra/deploy.sh.

Assets 19