VersionSec 0.7.2

A metadata and documentation patch. No runtime security behaviour changed.

Scanning, configuration review, runner review, scoring, schemas, finding IDs and the compatibility surface are all identical to 0.7.1. 0.7.1 remains functionally valid; 0.7.2 is the preferred current release because its distribution metadata and public documentation are fully corrected.

Why this release exists

PyPI stores a release description at upload time. The versionsec 0.7.1 description therefore permanently carries fifteen relative README links that resolve under pypi.org and return 404 — for example https://pypi.org/project/versionsec/MIGRATION.md. The README on main was already fixed, but a published description cannot be corrected in place and a released artifact must not be re-uploaded. This release is what delivers the fix.

Changes

• Documentation links in the long description are absolute canonical URLs.
• docs/INTEGRATION_TESTING.md names the current wheel.
• tests/test_long_description_links.py locks the README to portable links and checks the paths it references still exist. Structural, no network access.
• Compatibility bridge forgeguard moves to 0.7.2 and pins versionsec==0.7.2.

Verification

pytest                       433 passed  (426 + 7 new link tests)
migration tests              20 passed
subprocess release contract  23 passed
ruff check / format          clean
twine check                  PASSED (wheel + sdist)
long-description links       27 total, 0 broken

Artifacts are the exact bytes qualified by the trusted push run; nothing was rebuilt for this release. Attestation verifies against this repository, and both a wrong-repository check and a single-byte mutation are correctly rejected.

SHA-256

ea7d40357d808ed490113a62b6dae7fe4af7e655b61c687c77689b4041828f5d  versionsec-0.7.2-py3-none-any.whl
fcbacb335a17d43436c819507fdb968a12ff0754644ea6ee7e0e73fc5221b79d  versionsec-0.7.2.tar.gz

The tag is an annotated, unsigned tag, the same as v0.7.1. No VersionSec signing identity exists on the release host and none was created for this run.

VersionSec 0.7.1

VersionSec 0.7.2 is the current patch release. 0.7.1 remains functionally valid; 0.7.2 corrects distribution metadata and documentation links. The artifacts below are unchanged.

VersionSec 0.7.1 supersedes 0.7.0. 0.7.0 shipped with a defect in the command-line version flag; this patch fixes it and adds the tests that should have caught it.

Fixed

• versionsec --version exited with code 2 and Error: No such option: --version. It now exits 0 and prints VersionSec 0.7.1.
• forgeguard --version had the same defect. It now exits 0 and prints VersionSec 0.7.1 (forgeguard compatibility CLI) - identifying itself as the compatibility entrypoint without presenting ForgeGuard as the current brand.

Only the version flag was affected. Live scanning, offline configuration review and offline runner review behaved correctly in 0.7.0.

Added

• tests/test_release_contract.py: every documented command now runs as a real subprocess against an installed console script, in the source environment and in clean virtual environments built from the wheel and from the sdist. The 0.7.0 defect existed because the suite asserted __version__ and drove the CLI in-process, which cannot observe a missing option on an installed entrypoint.

Unchanged on purpose

• Stable FG-* finding identifiers.
• Machine-readable schema identifiers (forgeguard.assessment.v1, forgeguard.config-snapshot.v1, forgeguard.runner-snapshot.v1, forgeguard.scan-result.v0.3). These are contract identity, not branding, and no contract changed.
• v0.5.0, v0.6.0 and v0.7.0 and all their artifacts remain published and untouched.

Install

python -m pip install versionsec==0.7.1

Existing ForgeGuard users:

python -m pip install forgeguard==0.7.1   # compatibility bridge, installs versionsec==0.7.1

Verification

pytest                  426 passed (23 new release-contract tests), 95% coverage
ruff check / format     clean
build + twine check     PASSED (wheel + sdist)
clean venv from wheel   all 10 contract commands rc=0, pip check clean
clean venv from sdist   identical

The attached wheel and sdist are the exact artifacts built and attested by CI on 09bac1fbdf4c930f8063f32b6513a766ca537d6d. Verify provenance with:

gh attestation verify versionsec-0.7.1-py3-none-any.whl --repo gexiro-global/versionsec

PyPI

Published. Both distributions are public:

python -m pip install versionsec==0.7.1
python -m pip install forgeguard==0.7.1   # compatibility bridge, pins versionsec==0.7.1

Publication went through Trusted Publishing from this repository's release.yml, promoting the
frozen candidate set rather than rebuilding. The bytes on PyPI are the same bytes attached to
this release:

versionsec-0.7.1-py3-none-any.whl  9289e543a55335f0f77bdaa69950bbf314244f380b7cecb070f6a28fac2d9cc1
versionsec-0.7.1.tar.gz           ab3670a4e46f1b3fdcbf63b8c845b641a44523454335fbc66195f21e8bd8cd14

The compatibility bridge is metadata-only and is published separately by release-bridge.yml,
which refuses to upload unless the distribution is named forgeguard, depends on exactly
versionsec==0.7.1, ships dist-info only, and finds the canonical release already public.

Releases 0.2.0 through 0.6.0 of forgeguard remain published and unchanged.

(Updated after publication; this release's assets and tag are unchanged.)

VersionSec 0.7.0

VersionSec 0.7.0

ForgeGuard is now VersionSec. The product, maintainer, licence and scope are unchanged - only the name changed, starting with this release.

Install

python -m pip install versionsec==0.7.0

Compatibility bridge for existing users (installs VersionSec):

python -m pip install forgeguard==0.7.0

What changed

	up to 0.6.0	0.7.0
Distribution / import / CLI	forgeguard	versionsec
Repository	gexiro-global/forgeguard	gexiro-global/versionsec
Site	product page on gexiro.com	https://versionsec.com
Token env var	FORGEGUARD_TOKEN	VERSIONSEC_TOKEN

Compatibility - existing users are not abandoned

Covered by 20 dedicated tests in tests/test_migration_0_7.py:

• import forgeguard and import forgeguard.cli keep working and return the same module objects as versionsec.* - a shim, not a second implementation that could drift.
• The forgeguard console script is still installed and runs the canonical CLI.
• The legacy import path is silent: no warning on stdout or stderr, so existing automation is unaffected.
• FORGEGUARD_TOKEN is still read; when both are set, VERSIONSEC_TOKEN wins (deterministic precedence).
• forgeguard==0.7.0 is a metadata-only bridge depending on versionsec==0.7.0.

Deliberately unchanged

Renaming these would silently break existing report pipelines, suppression lists and SARIF baselines:

• every FG-* finding identifier (FG-VER, FG-ANON, FG-CONFIG-*, FG-RUNNER-*, FG-CVE-*, FG-FJ-*);
• the machine-readable schema identifiers forgeguard.assessment.v1, forgeguard.config-snapshot.v1, forgeguard.runner-snapshot.v1, forgeguard.scan-result.v0.3.

Human-facing branding did change: report title, Markdown header/footer, SARIF driver name and User-Agent now read VersionSec.

Capabilities (unchanged from 0.6.0)

Separate Gitea or Forgejo providers, bounded read-only GET-only live assessment, offline configuration review, offline Actions runner review with the eight FG-RUNNER-* checks, Markdown/JSON/SARIF 2.1.0 output, deterministic completeness semantics.

Qualification targets: Gitea 1.26.4 / 1.27.3, Forgejo 15.0.8 / 16.0.4, Gitea Runner 3.4.2, Forgejo Runner 13.0.0 / 13.1.0 - the exact tested targets, not a universal support promise.

Verification for this release

• Source bb97366b154432f2ee70f37a08cb533711300f8b (tag v0.7.0), built on trusted push run 34630928644.
• 403 tests pass on Python 3.11 and 3.12 (383 existing + 20 new migration tests); coverage 96%.
• Ruff lint/format, compile, pip check, python -m build and twine check all clean.
• Both attached artifacts were installed in clean virtualenvs and exercised through the canonical and the legacy CLI, including a real runner review run.

Wheel SHA-256: 31e00d7bf76b3b5c68ba05294ffd1117a36ad8598d92493c1bbb1ce588a22870
sdist SHA-256: 43483681b6b588dd935f3fb8f310b129313d3e978521ad2b423bbf82d6f4822c

Older releases

ForgeGuard 0.2.0, 0.2.1, 0.2.2, 0.5.0 and 0.6.0 remain published on PyPI under the forgeguard name, unchanged, with their original hashes and original release notes. They were called ForgeGuard and the historical record still says so.

Boundaries

Read-only, single target, GET-only for live assessment and fully offline for configuration and runner review. No exploitation, no target discovery, no mass scanning, no security or compliance certification, no compromise determination. Use only on an instance you own or are explicitly authorized to assess.

See MIGRATION.md and CHANGELOG.md.

---

Erratum (added 2026-09-11, after release)

0.7.0 has a defect in the command-line version flag. versionsec --version and forgeguard --version exit with code 2 and Error: No such option: --version.

This erratum does not claim that scanning, offline configuration review or offline runner review are broken - those behave correctly in 0.7.0. Only the version flag is affected.

VersionSec 0.7.1 fixes it and supersedes this release. Use 0.7.1.

The 0.7.0 tag, assets and hashes above are unchanged and remain valid historical state; nothing in this release was replaced.

v0.6.0

ForgeGuard 0.6.0 -- Control Plane Hardening

Adds forgeguard runner review: an offline, zero-network assessment of one operator-declared Gitea or Forgejo Actions runner's security posture, validated against a new closed schema forgeguard.runner-snapshot.v1. It never reads runner credentials, .runner files, Docker/registry secrets, or repository secrets.

Added since 0.5.0

• Eight provider-aware checks: FG-RUNNER-VERSION, -EXECUTION, -PRIVILEGED, -VOLUMES, -DOCKER, -NETWORK, -EPHEMERAL, -PLUGIN. Severity depends on the declared workload_trust (trusted-only vs mixed-untrusted), never on runner version alone.
• When execution_engine=host, the four container-specific checks correctly report not_applicable instead of re-penalizing one root cause five times.
• Runner qualification: Gitea Runner 3.4.2 and Forgejo Runner 13.0.0 / 13.1.0, each independently verified via the exact, checksum-verified official release binary's own --version and generate-config output. Full upstream citations with retrieval dates and hashes in docs/UPSTREAM.md, including gitea/runner#1058 (host-escape container.options hardening) and the Forgejo Runner 13.0.0 registry-credential-leak and workflow-command-injection fixes.

Compatibility

forgeguard.config-snapshot.v1 is unchanged; 0.5.0 config-review snapshots remain valid.

Qualification (this exact release)

• Source: f11aa72a18a5648e90ed605bab729561a7315afe (tag v0.6.0), qualified on trusted push run 34621416236, attempt 1.
• 383 tests pass on Python 3.11.16 and 3.12.14; coverage 95.58% (>= 91.28% required). Ruff lint/format, compile, pip check green.
• 16/16 real upstream container variants (Gitea 1.26.4/1.27.3, Forgejo 15.0.8/16.0.4, public/private, registration on/off) with 16 enforced configuration read-backs.
• 2/2 TLS/subpath/local-CA cases with verified cleanup.
• Fresh SBOM and dependency audits across runtime(19)/dev(52)/build(2) environments -- 0 vulnerabilities.
• Attestation independently verified against the exact published files.

Wheel SHA-256: 3bc1d34edff1ca77076b8593c26b242589a44a93c6a7f8acc0aafa6acf4e8ca3
sdist SHA-256: f93e0b02a6e3892cf57fe2b3159d5eaa5eb491fe71df50172e38fb8cc4431ad6

Install

python -m pip install forgeguard==0.6.0

Scope and boundaries

ForgeGuard remains read-only, single-target, GET-only (for scan) or fully offline zero-network (for config review and runner review), and limited to instances/runners the operator owns or is explicitly authorized to assess. No exploit proof, no mass scanning, no security certification, no compromise determination, and no complete-security guarantee.

See CHANGELOG.md for full history, README.md and docs/RUNNER_REVIEW.md for usage.

v0.5.0

ForgeGuard 0.5.0

Multi-Forge release: read-only security posture checks for self-hosted Gitea or Forgejo, offline configuration review of an explicitly supplied snapshot, and JSON/Markdown/SARIF exports.

Added since 0.2.2

• Separate Gitea and Forgejo providers with operator-declared product identity (one target per invocation, --product gitea or --product forgejo).
• Finite, hashed, provider-specific advisory catalogs (Gitea retains CVE-2026-27771, adds CVE-2026-78433; Forgejo covers its 2026-09-10 template-initialization security change for the proven fixed releases).
• Offline configuration review of an explicitly supplied anonymized snapshot (forgeguard config review), with minimal/standard/extended scopes and public/private/unspecified policy intent.
• SARIF 2.1.0 export alongside Markdown and JSON.
• Deterministic completeness semantics: a normal A-F grade appears only when every core check is assessed; missing or ambiguous evidence produces N/A, never a fabricated PASS.

Qualification (this exact release)

• Source: 2eee87960d325ad2cb755bb0ffcf3637d6b0335a (tag v0.5.0), qualified on trusted push run 34605494277, attempt 1. This commit's only change over the tested 5bd1dc9 is a CI step that uploads the qualification-evidence artifact for the release preflight; no forgeguard/ package content changed.
• 356 tests pass on Python 3.11.16 and 3.12.14; coverage 95.09% (>= 91.28% required). Ruff lint/format, compile, pip check green.
• 16/16 real upstream container variants (Gitea 1.26.4/1.27.3, Forgejo 15.0.8/16.0.4, public/private, registration on/off) with 16 enforced configuration read-backs.
• 2/2 TLS/subpath/local-CA cases with verified cleanup.
• Reproducible wheel and sdist; CycloneDX 1.6 SBOM; runtime/dev/build dependency audits reconciled by set, 0 vulnerabilities.
• Attestation independently verified against the exact published files, including a negative byte-mutation refusal test.

Wheel SHA-256: feabb017c402a81294edc6a3340f6dc126730c262b22dd64167257f5923788b3
sdist SHA-256: ea89f2078253361d165d9f2c8d2a2e01bc65100bf657f3477b1bfa04293fc88c

Install

python -m pip install forgeguard

Scope and boundaries

Qualification targets are Gitea 1.26.4/1.27.3 and Forgejo 15.0.8/16.0.4 - these are the exact tested targets, not a universal support promise for every release in either branch. ForgeGuard remains read-only, single-target, GET-only, and limited to instances the operator owns or is explicitly authorized to assess. No exploit proof, no mass scanning, no security certification, no compromise determination, and no complete-security guarantee.

See CHANGELOG.md for full history and README.md for usage.

v0.2.2

ForgeGuard 0.2.2

Truth-correction and semantic-integrity release for the read-only Gitea posture checker.

Corrected

• require trusted Gitea product confirmation for Gitea advisory conclusions
• model CVE-2026-27771 as affected, fixed, or unknown version posture
• produce N/A when core evidence is indeterminate
• keep browser and API evidence ownership disjoint
• require an explicit non-empty remote version before reporting disclosure
• neutralize untrusted Markdown output and refuse output-path collisions
• reject nested encoded dot segments and backslash separators

Release safety

• Python 3.11 and 3.12 quality matrix
• wheel and sdist validation
• exact-wheel install, metadata, dependency, and CLI smoke gates

ForgeGuard remains GET-only, single-target, and limited to instances the operator owns or is explicitly authorized to assess.

v0.2.1

Packaging hardening: dependency upper bounds, Trove classifiers, py.typed inline-typing marker, and PEP 639 license metadata. Published to PyPI via GitHub OIDC Trusted Publishing with signed PEP 740 attestations.

ForgeGuard v0.2.0

Read-only security posture self-check for self-hosted Gitea/Forgejo. Own/authorized instances only.

Install:

python -m pip install forgeguard

Highlights (v0.2):

• Version / patch-currency posture (CVE-2026-27771)
• Container-registry anonymous-exposure posture (/v2/)
• Sign-in / anonymous-access posture
• Deterministic score with a before/after example (66/100 C -> 100/100 A after patching)

Read-only HTTP GET checks only - no exploit, no mass scanning, no artifact retrieval.

PyPI: https://pypi.org/project/forgeguard/0.2.0/