0.79.0

Pinned protocol sources now work in a pod without egress or on a Kubernetes fsGroup volume, and the ESS pin is 0.77.0.

Changed

• AEP_FETCH_TIMEOUT_SECS (default 60 s) bounds a pinned fetch; the refusal names the pin, the cache and AEP_CACHE_DIR.
• AEP_CACHE_GROUP_WRITABLE=1 admits a snapshot its group can write (fsGroup); one others can write is always refused.
• A verification stamp its group or others can write is no longer trusted without that declaration.
• ESS pin 0.77.0; evidence admits ess-conformance/58 and /59.

CHANGELOG