Skip to content

Permesh 0.1.0-alpha.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@Cylop Cylop released this 08 Sep 20:33
v0.1.0-alpha.2
aad5839
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Permesh 0.1.0-alpha.2

Know who has access to what.

Second CLI prerelease for evaluation. Permesh remains local-first and read-only, with no backend or telemetry. This is not stable v0.1.

Changes since alpha.1

  • Browser OAuth login for explicitly trusted and approved external providers declaring the flow: auth login INSTANCE --browser, with --no-open for manual browser opening. The CLI owns PKCE, callback validation, cancellation and refresh-credential storage in the OS keychain.
  • Explicit Google provider migration preserving identity mappings, authority and credential references.
  • Native Unix terminal acceptance checks, target-bound dependency inventories, and verified GitHub build provenance.

GitHub 0.1.0 remains the only published official provider package. Google 0.1.1, Cloudflare 0.1.0 and AWS 0.1.0 are unpublished drafts awaiting live acceptance. CLI upgrades do not install, update or trust providers automatically.

Qualification

Released source: aad58397e139ed755fcf983da8e9f045e7e5a556. The release contains the original verified artifacts from attested native run 34273757910, without rebuilding or recompression.

CI and fresh dependency checks passed at this exact source. All five native targets passed tests, builds, packaging and synthetic smoke checks. The 20 artifact subjects were independently verified using both the distributed bundle and GitHub's attestation API, pinned to the source, signer, workflow identity, main ref and GitHub-hosted runners. Packaged CLI acceptance includes the offline demo and explicit public GitHub provider install/update checks in isolated local state.

Fresh public downloads of all 21 release files matched the qualified sizes and SHA-256 digests. All 20 signed subjects passed structural checks and provenance verification again through both the published bundle and public attestation lookup. The public Mac Apple Silicon binary also passed the offline demo and isolated GitHub provider install/update acceptance checks.

Verify before extracting

Download your archive, its checksum and attestation-bundle.json. With a current GitHub CLI:

gh attestation verify DOWNLOADED_FILE \
  --repo NIPE-Solutions/permesh \
  --cert-identity https://github.com/NIPE-Solutions/permesh/.github/workflows/attested-candidates.yml@refs/heads/main \
  --source-digest aad58397e139ed755fcf983da8e9f045e7e5a556 \
  --signer-digest aad58397e139ed755fcf983da8e9f045e7e5a556 \
  --source-ref refs/heads/main \
  --predicate-type https://slsa.dev/provenance/v1 \
  --deny-self-hosted-runners \
  --bundle attestation-bundle.json

Omit --bundle and its argument to verify through public attestation lookup. Verify the checksum as well; see installation. The bundle is not itself one of the 20 attested subjects; its signature is verified against the trusted issuer.

Evaluation limits

  • Executables have no Apple Developer ID/notarization or Windows Authenticode distribution signatures. Build provenance does not replace OS signing or establish reproducible builds.
  • Native jobs qualify their actual runner environments. Linux binaries use Ubuntu 24.04 system libraries; no musl, static-linking or older-OS compatibility claim is made.
  • Real Google consent and directory visibility, Cloudflare/AWS acceptance, broader GitHub permission/inheritance fixtures, Windows terminal behavior and interactive desktop credential stores remain open.
  • AWS source currently uses named credential references and reports IAM policy attachments with unknown effective privilege. Native AWS profiles/SSO refresh and effective-policy evaluation remain unsupported.
  • The dependency inventory is Permesh format 1, not a CycloneDX/SPDX SBOM. Package-manager distribution and CLI self-update remain future work.

Existing alpha.1 and GitHub provider 0.1.0 assets remain unchanged. Provider data and credentials were not included in these release artifacts or qualification evidence.

Files

Twenty attested subjects plus the verified bundle:

File Bytes SHA-256
attestation-bundle.json 15312 564e7b3c7441afb3a156d0078bca70945219c3680fc62a9c337fff27889408db
permesh-0.1.0-alpha.2-aarch64-apple-darwin.dependencies.json 107584 bd43b76627d644b92e9ac4aa4a8b97a5e3244ffa1544f67ea6f0c7f8e67cc564
permesh-0.1.0-alpha.2-aarch64-apple-darwin.dependencies.json.sha256 127 ad150408cf611d241162ae7af48129e5852d061a04825ef1fd0f95de6fedbfc2
permesh-0.1.0-alpha.2-aarch64-apple-darwin.tar.gz 4260880 f45f4668539e1c8aee299c131d9f1b6db08fcf2aed666e488f717336abea87d6
permesh-0.1.0-alpha.2-aarch64-apple-darwin.tar.gz.sha256 116 2a73b671bcb3ab8a09eecd15212b2ef1b305d57ebc8178022fe8cbe8b01259e7
permesh-0.1.0-alpha.2-aarch64-unknown-linux-gnu.dependencies.json 140715 bccfb50c2ae2db4b9bd4a3bcb19869fe8b61b4a72afaa7198be05f8dbc00e312
permesh-0.1.0-alpha.2-aarch64-unknown-linux-gnu.dependencies.json.sha256 132 792cdfe26d3dfc56508cf73178176d802296b4548c6dbc2c59ed846e53bae539
permesh-0.1.0-alpha.2-aarch64-unknown-linux-gnu.tar.gz 5392925 dd9d0c8592fd7b6bb5b1e89ddde0928fe8d01aceb864204b3114061d859607db
permesh-0.1.0-alpha.2-aarch64-unknown-linux-gnu.tar.gz.sha256 121 bb95ba52df1c64de4f44eb0eedcd461b7d090c19f82d13fec7ef2c0837baefc3
permesh-0.1.0-alpha.2-x86_64-apple-darwin.dependencies.json 109480 a09a8e1a3feebb8fca48ae8958016a5bd6a14b5086cd1a0af2c7334e206188ee
permesh-0.1.0-alpha.2-x86_64-apple-darwin.dependencies.json.sha256 126 81bdad3f220004b571285fad3a508010e39b5452c58f1881465663c8c99807ab
permesh-0.1.0-alpha.2-x86_64-apple-darwin.tar.gz 4581184 7844e10867025724a073c4af632cef0036880d19e9d9da6f55cc7cec432af70e
permesh-0.1.0-alpha.2-x86_64-apple-darwin.tar.gz.sha256 115 6ccfa7c3cbae856ae26349de49ab1e13538b8b17c57cbee11a4dc42bfa7d1e92
permesh-0.1.0-alpha.2-x86_64-pc-windows-msvc.dependencies.json 114127 0500371a43c06d332786ce497d93df214e4237e70d1b0afd55be34bb4777c02d
permesh-0.1.0-alpha.2-x86_64-pc-windows-msvc.dependencies.json.sha256 129 68cff3f52b67ce4b032e4751977a99168cdb6f719a0acfafe07edda5ff389f16
permesh-0.1.0-alpha.2-x86_64-pc-windows-msvc.zip 4921611 75612c5c4b41fa5bcfbed1948a89daae7d1f50f87f8da6a2cae4501271ef2280
permesh-0.1.0-alpha.2-x86_64-pc-windows-msvc.zip.sha256 115 985fbd737533e0a8ccdc05a8378548aa9627d4db9c60baa5204287f6f7f4ebc0
permesh-0.1.0-alpha.2-x86_64-unknown-linux-gnu.dependencies.json 142611 1992f6d75ea7e61d412fc02a3cfec6f065f9f4a5fee2165e3c225220a1e8c9b1
permesh-0.1.0-alpha.2-x86_64-unknown-linux-gnu.dependencies.json.sha256 131 846bef5c20ce17554217c7ebdd088f46705fc66e04de465b05161a4c25aae30c
permesh-0.1.0-alpha.2-x86_64-unknown-linux-gnu.tar.gz 5797310 cbedb2d56dc8cf12119481bef323d8c0bcca73517769f5aa8fedf24e70acc033
permesh-0.1.0-alpha.2-x86_64-unknown-linux-gnu.tar.gz.sha256 120 f0c9262b58adfe6b6b3e584032716e6ca2442d336c57745fbc1fcf68fbcf159c
Assets 23
Loading