Skip to content

varve v0.12.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Aug 08:28
· 3 commits to main since this release
v0.12.1
This tag was signed with the committer’s verified signature.
avrabe Ralf Anton Beier
SSH Key Fingerprint: 5yELJMbRldVoXWU2u9E8p8a9GUJCyQLyinKHfADgAOE
Verified
Learn about vigilant mode.
b71b7ce
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

varve v0.12.1 — audit hardening

Independent ASPICE/ISO-26262 and cybersecurity audits (2026-08-08) — the actionable, no-decision findings, fixed and gated.

  • F2 fail-open (security): a signed manifest with a malformed issued-at parsed fine and silently disabled the staleness warning, voiding SH-002. issued-at is now validated as a real RFC 3339 date at parse (impossible dates — Feb 31 — rejected), by the one epoch_days validator the staleness verdict uses.
  • Potency: the cargo-mutants trust-critical gate + strict policy are now required merge checks (the audit found REQ-MUTATE-001 verified-but-bypassable). It proved itself immediately — the F2 fix's new guards had 9 uncaught mutants and the gate blocked the merge until they were killed.
  • Honesty: README no longer claimed "nothing implemented" (against 14 releases); the claim-check now covers the status banner. SECURITY.md added — disclosure policy, the invariants a report should target, and the current provisional-trust limits.
  • Hazards: SH-005 (root-key compromise) + SH-006 (deposit-pipeline compromise) + SC-005/006 — the two the STPA-Sec seed hadn't named.
  • Supply chain: Cargo.lock tracked, releases build --locked; cargo-deny in CI (advisories/licenses/sources); cross tag-pinned; ci.yml + release.yml actions SHA-pinned; the rivet cosign identity regexp anchored (was matching rivet-evil).

Verify: varve self-verify --archive varve-v0.12.1-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json. This machine self-updated 0.12.0 → 0.12.1 through the old-verifies-new chain.

Assets 13
Loading