fix(acquisition): require canonical release and data-room authority - #501

Draft

seonghobae wants to merge 100 commits into

mainfrom

fix/acquisition-data-room-canonical-authority

Commits on Aug 23, 2026

test(acquisition): reject normalized data-room authority
seonghobae
committed
38e5e6e
fix(acquisition): preserve exact data-room authority bytes
seonghobae
committed
5c2cd77
fix(acquisition): validate exact retained authority
seonghobae
committed
6c4d4e8
test(acquisition): require lowercase source authority
seonghobae
committed
1fcd47c
test(acquisition): reject non-canonical SemVer tags
seonghobae
committed
357e5e7
fix(acquisition): require canonical SemVer tag authority
seonghobae
committed
22249d2
fix(acquisition): require canonical retained SemVer authority
seonghobae
committed
723819f
test(release): reject normalized release identity authority
seonghobae
committed
b0b0aa7
fix(release): preserve exact identity authority bytes
seonghobae
committed
8837e0b
test(release): reject normalized publication identity authority
seonghobae
committed
d085664
fix(release): preserve exact publication authority bytes
seonghobae
committed
e8476ce
test(release): reject ambiguous workflow-run evidence URLs
seonghobae
committed
92a015e
fix(release): bind verification to exact Actions run URL
seonghobae
committed
7bdbe47
test(release): reject ambiguous SBOM bom-ref identities
seonghobae
committed
bb89c8b
fix(release): require canonical SBOM bom-ref identities
seonghobae
committed
864b5c0
test(release): reject dangling SBOM dependency identities
seonghobae
committed
8513add
fix(release): bind SBOM dependency graph to declared identities
seonghobae
committed
da61018
test(release): cover fail-closed SBOM dependency graph branches
seonghobae
committed
dc376df
test(acquisition): reject normalized diligence tag authority
seonghobae
committed
2fb1a4b
fix(acquisition): preserve exact diligence tag authority
seonghobae
committed
5e4682a

Commits on Aug 24, 2026

fix(exchange): reject non-canonical target repository authority (#499)
seonghobae
authored
2c83355
test(release): require complete SBOM dependency graph
seonghobae
committed
0df3391
fix(release): require complete SBOM dependency graph
seonghobae
committed
b5b6063
Merge b5b60632a1b3a138766ac057574c5a4c8bcff08f into 2c83355529447248c246805d1954f268e027d2ab
seonghobae
authored
a666b02
test(release): model complete buyer SBOM dependency graph
seonghobae
committed
13d65f8
test(release): reject control bytes in bom-ref authority
seonghobae
committed
94484c5
fix(release): reject ambiguous bom-ref control bytes
seonghobae
committed
11936b3
test(release): require release evidence in exact coverage
seonghobae
committed
a11048c
fix(release): cover canonical SBOM authority
seonghobae
committed
33f9af3
test(release): reject ambiguous Unicode bom-ref spaces
seonghobae
committed
c4f4720
fix(release): reject ambiguous Unicode bom-ref spaces
seonghobae
committed
5c371d6
test(release): preserve canonical ASCII bom-ref spacing
seonghobae
committed
7618c3d
fix(release): preserve canonical ASCII bom-ref spacing
seonghobae
committed
3143c97
test(release): reject normalized checksum authority
seonghobae
committed
31e8b8c
fix(release): require canonical checksum authority
seonghobae
committed
4a25e38
test(release): cover blank checksum authority lines
seonghobae
committed
62f3520
test(release): reject duplicate checksum authority
seonghobae
committed
97970e6
fix(release): reject duplicate checksum authority
seonghobae
committed
11a199d
test(release): reject non-NFC SBOM authority
seonghobae
committed
4677fc5
fix(release): require NFC SBOM authority
seonghobae
committed
218d455
test(release): reject surrogate SBOM authority
seonghobae
committed
ad0baff
fix(release): reject surrogate SBOM authority
seonghobae
committed
0cf5982
test(acquisition): align integration timeout with bounded audit
seonghobae
committed
2f4c289
test(release): prevent bom-ref leakage in failures
seonghobae
committed
fbadde3
fix(release): redact bom-ref failure authority
seonghobae
committed
7823997
test(release): redact hostile SBOM metadata
seonghobae
committed
3fd357f
fix(release): redact untrusted SBOM metadata
seonghobae
committed
5fcf215
test(release): avoid static token-like fixture
seonghobae
committed
00590e5
test(release): avoid static metadata token fixture
seonghobae
committed
6fdd411
test(release): prevent malformed JSON log leakage
seonghobae
committed
297a862
fix(release): redact malformed JSON parse context
seonghobae
committed
fc353ac
test(release): fail closed on excessive SBOM nesting
seonghobae
committed
22907f7
fix(release): bound CycloneDX nesting depth
seonghobae
committed
13acdab
test(release): require nested components in dependency graph
seonghobae
committed
67e9eaf
fix(release): require nested components in dependency graph
seonghobae
committed
058f409
test(release): reject malformed nested component assemblies
seonghobae
committed
df97e32
fix(release): validate nested component assembly shape
seonghobae
committed
6aaaa00
test(release): count nested SBOM components
seonghobae
committed
0738f90
fix(release): count nested SBOM components
seonghobae
committed
c2a7d30
chore(release): preserve source byte boundary
seonghobae
committed
7e1f1d2
test(release): reject empty explicit identity overrides
seonghobae
committed
3c869cf
test(release): cover empty explicit generated-at override
seonghobae
committed
db4fafa
fix(release): fail closed on empty explicit identity overrides
seonghobae
committed
d353ca4
test(release): reject empty publication identity overrides
seonghobae
committed
7dfd5c1
fix(release): fail closed on empty publication identity overrides
seonghobae
committed
60b8eb2
test(release): reject symlinked evidence parents
seonghobae
committed
a4b7a12
fix(release): reject symlinked evidence parents
seonghobae
committed
a1dae7c
test(release): reject symlinked publication parents
seonghobae
committed
58e1eb6
fix(release): bind publication inputs to real parents
seonghobae
committed
48fd6b3
docs(release): describe parent-path evidence binding
seonghobae
committed
5e5e61b
test(release): reject non-RFC4122 SBOM serial UUIDs
seonghobae
committed
c2ad18b
fix(release): enforce RFC4122 SBOM serial UUID semantics
seonghobae
committed
699ab92
test(sbom): reject BOM-Link-prefixed bom-ref authority
seonghobae
committed
b63066c
fix(sbom): reject BOM-Link-prefixed bom-ref authority
seonghobae
committed
608b70f
test(release): reject non-gzip source evidence
seonghobae
committed
67577fb
fix(release): verify bounded gzip source evidence
seonghobae
committed
61d4f74
test(release): use real gzip source fixture
seonghobae
committed
b8c1b9b
test(release): use real gzip source fixture
seonghobae
committed
cb6ec44
test(release): normalize gzip source fixtures
seonghobae
committed
baef8a1
test(sbom): reject nil release serial identity
seonghobae
committed
7947bdc
fix(sbom): require unique non-nil release serial identity
seonghobae
committed
d5e9809
test(acquisition): reject parent symlink after output open
seonghobae
committed
e88e626
fix(acquisition): recheck parents after private output open
seonghobae
committed
b964029
test(acquisition): reject parent symlink after staging open
seonghobae
committed
a102704
fix(acquisition): recheck parents after staging output open
seonghobae
committed
5f4d11e
test(acquisition): remove partial new output after write failure
seonghobae
committed
2be21fd
fix(acquisition): clean partial new private output on failure
seonghobae
committed
a48a136
test(release): use valid gzip source fixture
seonghobae
committed
400c7d7
test(release): gzip nested component fixture
seonghobae
committed
5e88e31
test(release): assert malformed nested component diagnostic
seonghobae
committed
a22a5c7
test(acquisition): cover unauthenticated cleanup guard
seonghobae
committed
1d9d590
test(acquisition): reject hard-linked release evidence
seonghobae
committed
1a006ff
fix(acquisition): reject hard-linked release evidence
seonghobae
committed
6b2b596
test(release): reject hard-linked publication evidence
seonghobae
committed
5fc3fd6
fix(release): reject hard-linked publication evidence
seonghobae
committed
621e421
test(acquisition): detect retained-evidence version races
seonghobae
committed
cc3d93d
fix(acquisition): bind evidence path to file version
seonghobae
committed
af0780b

Commits on Aug 27, 2026

test(release): reject dot-segment symlink parent bypass
seonghobae
committed
2f6bcfc
test(release): clarify canonical evidence path contract
seonghobae
committed
e2c676a
fix(release): reject dot-segment evidence path aliases
seonghobae
committed
8789922