fix: v0.12.1 — audit hardening (fail-open, potency, honesty, supply chain)

.github/workflows/ci.yml

@@ -19,11 +19,11 @@ jobs:
     name: fmt · clippy · test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: rustfmt
         run: cargo fmt --all --check
       - name: clippy
@@ -35,8 +35,8 @@ jobs:
     name: rivet validate · release plan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: sigstore/cosign-installer@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
       - name: fetch rivet (pinned, digest-checked, cosign-verified)
         run: |
           set -euo pipefail
@@ -45,7 +45,7 @@ jobs:
             -p SHA256SUMS.txt -p SHA256SUMS.txt.cosign.bundle
           cosign verify-blob \
             --bundle SHA256SUMS.txt.cosign.bundle \
-            --certificate-identity-regexp 'github.com/pulseengine/rivet' \
+            --certificate-identity-regexp '^https://github.com/pulseengine/rivet/' \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
             SHA256SUMS.txt
           sha256sum -c <(grep "x86_64-unknown-linux-gnu" SHA256SUMS.txt)
@@ -67,14 +67,24 @@ jobs:
       - name: coverage report (informational)
         run: rivet coverage || true
 
+  deny:
+    name: cargo deny (supply-chain audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Install cargo-deny
+        run: cargo install --locked cargo-deny
+      - name: Audit dependencies (advisories, licenses, sources)
+        run: cargo deny check
+
   mutants:
     name: cargo mutants (trust-critical gate)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           key: mutants
       - name: Install cargo-mutants

.github/workflows/mutants.yml

@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           key: mutants-nightly
       - name: Install cargo-mutants
@@ -35,7 +35,7 @@ jobs:
         run: cargo mutants --no-shuffle || true
       - name: Upload mutation evidence
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: mutants-report-${{ github.run_id }}
           path: mutants.out

.github/workflows/release.yml

@@ -51,29 +51,29 @@ jobs:
             os: macos-latest
             archive: tar.gz
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           targets: ${{ matrix.target }}
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           key: release-${{ matrix.target }}
 
       - name: Install cross
         if: matrix.cross
-        run: cargo install cross --git https://github.com/cross-rs/cross --locked
+        run: cargo install cross --git https://github.com/cross-rs/cross --tag v0.2.5 --locked
 
       - name: Build varve (native)
         if: ${{ !matrix.cross }}
-        run: cargo build --release --target ${{ matrix.target }} -p varve
+        run: cargo build --release --locked --target ${{ matrix.target }} -p varve
 
       - name: Build varve (cross)
         if: matrix.cross
-        run: cross build --release --target ${{ matrix.target }} -p varve
+        run: cross build --release --locked --target ${{ matrix.target }} -p varve
 
       - name: Strip binary
         if: ${{ !matrix.cross }}
@@ -97,7 +97,7 @@ jobs:
           tar -czf "$ARCHIVE" -C staging .
           echo "ARCHIVE=$ARCHIVE" >> "$GITHUB_ENV"
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: binary-${{ matrix.target }}
           path: ${{ env.ARCHIVE }}
@@ -116,12 +116,12 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Download all build artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: artifacts
 
@@ -173,7 +173,7 @@ jobs:
       # keyless via Sigstore and recorded in Rekor. Consumers verify with
       # `gh attestation verify <file> --repo pulseengine/varve`.
       - name: Generate SLSA build provenance
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: "release-assets/*.tar.gz"
 
@@ -188,7 +188,7 @@ jobs:
       #     --bundle SHA256SUMS.txt.cosign.bundle \
       #     SHA256SUMS.txt
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
         with:
           cosign-release: 'v2.4.1'
 

.gitignore

@@ -1,5 +1,5 @@
 /target
 **/*.rs.bk
-Cargo.lock
+# Cargo.lock tracked (26262-8 config-management: releases must rebuild from VCS)
 .DS_Store
 /dist

CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## v0.12.1 — 2026-08-08
+
+Audit hardening. Independent ASPICE/ISO-26262 and cybersecurity audits
+(2026-08-08) found honesty, potency, and one fail-open defect; fixed here.
+
+- **F2 fail-open fixed (security)**: a signed manifest with a malformed
+  `issued-at` parsed fine and silently disabled the staleness warning
+  (voiding SH-002). issued-at is now validated as a real RFC 3339 date at
+  parse — malformed is refused; `epoch_days` rejects impossible dates
+  (Feb 31 no longer accepted). One shared validator for producer + verdict
+- **Potency fixed**: the cargo-mutants trust-critical gate and strict
+  policy are now REQUIRED merge checks — REQ-MUTATE-001's "verified" status
+  finally matches enforcement (the audit found it bypassable)
+- **Honesty fixed**: README no longer says "Nothing is implemented yet"
+  (false against 13 releases); claim-check now covers the status banner
+- **SECURITY.md** added — disclosure policy + the invariants a report
+  should target + the current provisional-trust limitations (the DM
+  practice the audit scored near zero, and varve's own criticalup critique)
+- **Two unmodeled hazards named**: SH-005 (root-key compromise — single
+  online key, no rotation/revocation/threshold) + SH-006 (deposit-pipeline
+  compromise), with SC-005/SC-006; both discharged at the v1.0 ceremony
+- **Supply-chain**: Cargo.lock now tracked, releases build `--locked`;
+  cargo-deny in CI (advisories/licenses/sources); `cross` pinned to a tag;
+  ci.yml + release.yml actions SHA-pinned; the rivet cosign identity
+  regexp anchored (`^https://…/rivet/`, was matching `rivet-evil`)
+
 ## v0.12.0 — 2026-08-08
 
 Close the graph, make claims mechanical (REQ-VGATE-001 + REQ-MUTATE-001