Skip to content

Rootloom Personal Core 3.1.0 — Precise Sensitive Material Review

Choose a tag to compare

View all tags
@qingye-lab qingye-lab released this 15 Jul 11:58
v3.1.0
4e010ea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rootloom Personal Core 3.1.0

3.1.0 refines Sensitive Material review policy so privacy quarantine remains strict without hiding ordinary reviewable security configuration.

Highlights

  • Classifies exact environment-secret forms (.env, .envrc, and non-template .env.<name>) as material while keeping .env.example, .env.sample, .env.template, and .env.dist patch-readable and high risk.
  • Keeps public certificate formats (.crt, .cer, .der, .p7b, and .p7c) patch-readable and high risk; private keys and keystores remain metadata-only.
  • Adds Intake-only begin_review.py --reviewable-path FILE for exact, existing, regular non-symlink files. The sealed declaration can downgrade ambiguous material such as a public .pem, but cannot override strong secrets or declared Sensitive roots.
  • Emits opt-in rootloom-change-baseline-v4 only when reviewable paths are declared. Default Intake remains baseline v3, and readers/sealers/Finalizer accept v2, v3, and v4.
  • Clarifies refusal diagnostics for a symlink target versus a symlinked parent component following release-review feedback.

Verification

  • Candidate clean-clone and final post-review local make check: 174 tests passed; one environment-only non-UTF-8 filename test skipped on the current macOS volume.
  • Corrected release PR #8 run 29408409629 passed all seven Linux, macOS, Windows, and Codex CLI jobs after review feedback was fixed.
  • Merged main run 29408654603 independently passed the same seven jobs before tagging.
  • Annotated v3.1.0 peels to release commit 4e010ea26c871a603a955b88ede8c5cea5066572.

See CHANGELOG.md for the complete compatibility and security notes.

Assets 2
Loading