release: verify sealed SBOM evidence before attestation - #54

Merged

seonghobae merged 31 commits into

mainfrom

feature/sealed-release-evidence-verifier

Aug 6, 2026

Commits on Aug 5, 2026

test: define sealed release evidence API
seonghobae
committed
b908a39
test: specify sealed evidence trust boundary
seonghobae
committed
50e0351
release: implement fail-closed evidence verifier
seonghobae
committed
e81c2b8
docs: define sealed evidence handoff contract
seonghobae
committed
252c08a
docs: record sealed release evidence verifier
seonghobae
committed
9b0e780
security: preserve evidence-directory symlink boundary
seonghobae
committed
270848d
test: reject public evidence-directory symlink traversal
seonghobae
committed
beceb43
style: use modern callable import
seonghobae
committed
ee93da2
test: expose sealed evidence filesystem races
seonghobae
committed
adedffe
fix: bind sealed evidence to stable regular-file snapshots
seonghobae
committed
83370a0
test: cover sealed snapshot failure boundaries
seonghobae
committed
c11a615
docs: define immutable evidence snapshot boundary
seonghobae
committed
f1ae25a
style: combine snapshot test contexts
seonghobae
committed
12233c6
chore: record sealed evidence snapshot hardening
seonghobae
committed
e637b3c
test: expose sealed evidence resource-limit gaps
seonghobae
committed
06f0866
fix: bound sealed evidence snapshot reads
seonghobae
committed
1331710
test: align filesystem fault injection with bounded reads
seonghobae
committed
f12c22e
test: cover bounded snapshot filesystem failure
seonghobae
committed
b2f7974
test: reject post-verification checksum mutation
seonghobae
committed
c9bd881
fix: bind checksum file through manifest issuance
seonghobae
committed
749231d
docs: record checksum snapshot lifetime
seonghobae
committed
1224890
chore: record checksum lifetime hardening
seonghobae
committed
975a166
test: require exclusive strict manifest output
seonghobae
committed
a28cfcd
test: cover durable exclusive manifest output
seonghobae
committed
dc96722
fix: seal manifest output boundary
seonghobae
committed
ede4ba8
docs: define fail-closed manifest output
seonghobae
committed
4207522
test: expose CLI output symlink resolution gap
seonghobae
committed
471c225
security: preserve final manifest path for no-follow creation
seonghobae
committed
4b2f5b8
docs: record sealed manifest output
seonghobae
committed
b17e8a0

Navigation Menu

Uh oh!

release: verify sealed SBOM evidence before attestation - #54

release: verify sealed SBOM evidence before attestation#54
seonghobae merged 31 commits into
mainfrom
feature/sealed-release-evidence-verifier

Commits on Aug 5, 2026

test: define sealed release evidence API

test: specify sealed evidence trust boundary

release: implement fail-closed evidence verifier

docs: define sealed evidence handoff contract

docs: record sealed release evidence verifier

security: preserve evidence-directory symlink boundary

test: reject public evidence-directory symlink traversal

style: use modern callable import

test: expose sealed evidence filesystem races

fix: bind sealed evidence to stable regular-file snapshots

test: cover sealed snapshot failure boundaries

docs: define immutable evidence snapshot boundary

style: combine snapshot test contexts

chore: record sealed evidence snapshot hardening

test: expose sealed evidence resource-limit gaps

fix: bound sealed evidence snapshot reads

test: align filesystem fault injection with bounded reads

test: cover bounded snapshot filesystem failure

test: reject post-verification checksum mutation

fix: bind checksum file through manifest issuance

docs: record checksum snapshot lifetime

chore: record checksum lifetime hardening

test: require exclusive strict manifest output

test: cover durable exclusive manifest output

fix: seal manifest output boundary

docs: define fail-closed manifest output

test: expose CLI output symlink resolution gap

security: preserve final manifest path for no-follow creation

docs: record sealed manifest output

Commits on Aug 6, 2026

merge: integrate exact protected main into sealed evidence verifier

docs: preserve integrated release evidence changelog