Skip to content

SunLit Security Libraries 0.2.0

Choose a tag to compare

View all tags
@kerberosmansour kerberosmansour released this 14 Oct 13:25
· 31 commits to main since this release
v0.2.0
This tag was signed with the committer’s verified signature.
kerberosmansour Kerberosmansour
SSH Key Fingerprint: iJ2Dpg6vB9L1kQwenj5AMKbchX6EJJqOxfzmjciqu2I
Verified
Learn about vigilant mode.
bf52c98
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Coordinated security-maintenance release of all twelve SunLit libraries at 0.2.0, merged in PR #124. READMEs, sibling requirements, capability declarations and migration notes are updated.

Repairs cover JWKS transport/response bounds, hybrid-key Debug redaction, Unicode controls, circuit-breaker generation/unwind ownership, source attestation, dependency advisories and misleading redaction/FIPS/formal claims. Read-only daily scans/offline drills replace privileged agent auto-fix/merge loops. Release build/sign authority is separated.

All protected Linux/macOS/Windows, framework-feature, supply-chain, packaging and documentation gates passed; CodeQL, Semgrep, DAST, Kani and TLC are green. Each crate passed a publication dry run and its uploaded checksum matches the preserved package. CycloneDX 1.6 dependency SBOMs describe each packaged Cargo.lock, including optional/target/dev entries; they are metadata attachments, not runtime-only inventories or vulnerability certifications. The capability declaration is separate.

Seven exact scoped dependency dispositions expire 2026-11-14 and are enforced by CI. In particular, newer custom-secret/schema/codec APIs are not broadly approved; the mapped default-secret/legacy SDK paths are constrained and independently reviewed. Existing baseline cargo-vet exemptions remain explicit. No full native/cryptographic certification or cloud deployment is claimed. Consumers must audit their final graph and custom dependency use.

See CHANGELOG.md, docs/dev-guide/release-process.md, and supply-chain/maintenance-exceptions.json. Verify Sigstore artifact bundles against the exact release-sign.yml workflow identity and token.actions.githubusercontent.com issuer, then verify SHA256SUMS. Published versions are immutable; rollback requires a reviewed new release.

Release signing recovery: PR #126 passed all checks. Run https://github.com/kerberosmansour/SunLitSecurityLibraries/actions/runs/38570598294 retrieves the exact checksum-approved registry archives instead of repackaging. All 12 archive checksums, all 27 Sigstore payloads (including the 12 dependency SBOMs and release record) and SHA256SUMS verify locally. The recovered certificate identity is https://github.com/kerberosmansour/SunLitSecurityLibraries/.github/workflows/release-sign.yml@refs/heads/main. The original v0.2.0 library source tag remains unchanged at bf52c98; the signing workflow commit is ef4d41a.

Assets 56
Loading