Skip to content

gateway v0.2.0

Choose a tag to compare

View all tags
@kikashy kikashy released this 21 Aug 17:54
· 93 commits to main since this release
v0.2.0
9fdd9a3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Second release of the attested-input gateway: 29 commits of hardening, one verifier fix that changed what a verdict means on Windows, and the first external-contributor wave — twelve merged pull requests from five contributors, every one verified and mutation-tested before landing.

The verifier fix

On Windows, os.ReadDir on a regular file reports ERROR_PATH_NOT_FOUND, which os.IsNotExist treats as absence — so a store whose receipts path existed but was unreadable verified clean on that platform only. Found by a contributor's boundary test (#63), proved platform-split, and fixed (#71): absence is now decided by os.Stat, present-but-not-a-directory is a hard refusal, and ReadDir errors propagate unconditionally. SPEC.md §4.1's table now enumerates all three failure shapes explicitly — absent, present-but-not-a-directory, and a directory that cannot be read (#71, #75) — so a clean-room implementation cannot be steered into the removed behavior. Permission-fixture tests pin both error legs.

Hardening since v0.1.0

  • /acquire and /seal: request bodies bounded (#44), admission race-safe (#43), trailing JSON request values rejected (#37).
  • Verification follows §1.4's first-failure order exactly (#42).
  • gateway keygen refuses to replace an existing path (#41); gateway serve rejects duplicate and malformed --port (#39), duplicate source names (#31), malformed options before startup (#23), and source commands that do not resolve (#50).

The test wave

External contributors pinned, among others: keyIDFor's truncation against an independently computed digest (#51), the canon subcommand's byte-exact contract (#52), the receipt store's append-only refusal (#58), §4.1's graded verdicts for a missing receipts root (#59), the corpus README's vector counts (#60), readPublicKey's accepted and refused encodings (#61), JSON-only session counting (#70), and GET /registry as a byte-faithful anchor (#73). Several of these are the only guard in the tree for the property they hold — verified by mutation, not assumed.

Documentation

Runnable quickstart (#27) and a trust-boundary diagram (#29).

The frozen corpus is unchanged: 30 canon vectors, 19 store vectors, and gateway conform reports 0 disagreements on the tagged source.

Assets 2
Loading