Skip to content

v0.1.1 — Offline auditor fixes

Latest
Latest

Choose a tag to compare

View all tags
@dnlrsls dnlrsls released this 19 Oct 20:57
v0.1.1
9bdb1d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.1 — offline auditor fixes

This patch ships the reviewed repository-boundary/bootstrap fixes (#113) and lossless human uncertainty summaries (#114), with native release metadata prepared in #115. Scope remains offline audit, saved reports and conditional bootstrap dry-run; no new execution feature is admitted.

Changes and limits

  • Nested repositories with their own .git entry are excluded before descent; explicitly selected roots and ordinary nested packages remain auditable. Copies without markers are not silently excluded.
  • Root bootstrap proposals remain conservative: an excluded repository at the proposed destination or an ancestor still blocks the draft.
  • Human output groups exact rule/explanation records without removing scoped evidence. Counts are records, not confirmed defects. JSON-v1, exit meanings and UNKNOWN semantics are unchanged.

Tested native downloads

Choose your actual OS/architecture, verify the ZIP against SHA256SUMS, extract it and run ci-trust --version (ci-trust.exe on Windows). Expected output: ci-trust "0.1.1".

These are the exact archives retained by successful final-main native CI, not locally reconstructed cross-builds:

Archive SHA-256 Actual Go compiler / native job
ci-trust_0.1.1_windows_amd64.zip adb4e501aa86531efd57b7913e986bc2d325c48edf8523a83f6dbfc73b2a7ff2 go1.26.8 / native receipt
ci-trust_0.1.1_linux_amd64.zip 637d7cd683f4ae74029218857b3a1ebf399fb1b4a4c68ad0fb38d87dd43a8b6f go1.26.9 / native receipt
ci-trust_0.1.1_darwin_arm64.zip 356716d3ed0696819ff01b7dcd44cdba7165b6c2ab8b02d700994eacdab80868 go1.26.9 / native receipt

Source: 9bdb1d81270a8e9366ea7d3f0bc0342d0d9336ac. Final main native CI: run 39303361041, attempt 1. Successful owned Go/public-CLI tests, vet and native retention were checked on Linux, Windows and macOS; archive/source/run/log/binary/hash/license bindings were inspected. These checks exercise CI Trust, not the workflows it audits.

Archives include MIT project source licensing, third-party notices, upstream license texts and RELEASE.json compiler/platform/provenance metadata. No Node.js, npm, ESLint or container image is bundled. Binaries are unsigned and not notarized; checksums detect byte differences, not independent publisher identity.

Still deferred

Controlled lint verification and #9 remain experimental/incomplete and are not this offline release's acceptance gate. No accepted real CLEAN → expected FAULT diagnostic → RESTORED sequence, audited-CI execution, validator efficacy, complete coverage or required-check enforcement is claimed. Audit/report/bootstrap dry-run do not execute target code or apply changes; exit 0 may include findings, FAIL, UNKNOWN and conditional proposals. Runtime consent/isolation controls are unchanged.

Full patch notes · Previous release v0.1.0

Assets 6
Loading