Skip to content

v0.2.0

Choose a tag to compare

View all tags
@imran-siddique imran-siddique released this 30 Jun 20:08
· 105 commits to main since this release
v0.2.0
c0c254d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening release. trace-verify now verifies claim signatures by default (fail-closed); the registry verifies producer signatures before anchoring; outbound fetches are restricted to an https host allowlist (SSRF mitigation); producer-id path traversal is blocked. BREAKING for scripts that relied on inclusion-only success of trace-verify.

Assets 2
Loading