OBAAF 0.2.0

OBAAF 0.2.0

Breaking

• Signed record types now use addresses under https://www.obaaf.com/attestation/
  instead of the obaaf.example placeholder. Each address opens a page describing the
  format. Records signed with 0.1 templates do not verify under 0.2.

Checker, from the first pilot's feedback (issue #19)

• Findings are split into authority (what an attacker could make the pipeline do) and
  hygiene, and --fail-on authority:medium fails CI on authority findings only.
• Agents launched through repository shell scripts are detected.
• Unpinned actions in ordinary read-only jobs are rated low; agent, release and effect
  jobs stay high.
• Runners chosen at run time between hosted and self-hosted machines are informational.
• Findings that need the lane architecture rather than a one-line fix are flagged.

OBAAF's own supply chain

• Dependencies install by exact version and SHA-256 hash.
• The setup action picks a Python 3.10 or later interpreter and is tested on Linux,
  macOS and Windows.
• Every release file carries signed build provenance, checked before upload.
  Check a download yourself:
  gh attestation verify obaaf-0.2.0-py3-none-any.whl --repo Obaaf/OBAAF

Papers

• Paper 1: https://doi.org/10.5281/zenodo.23622566
• Paper 2: https://doi.org/10.5281/zenodo.23622802

Full changelog: CHANGELOG.md