open/repo-standard
1
0
Fork 0
Code Issues Releases 7 Activity
7 releases 21 tags
  • v0.11.0 e6cd8983ca

    v0.11.0 Stable

    ktg released this 2026-08-13 08:52:15 +00:00 | 12 commits to main since this release

    No known key found for this signature in database

    Added

    • TAG-SIGNED — a release tag that names a signer, not just whoever could
      write to the forge.       The catalog pins plugins by tag, so this sits on the
      same supply-chain axis as TAG-ANNOTATED: annotation makes a tag
      immovable-without-a-trace, a signature makes it attributable.

      The check had been parked for a release as "blocked on an operator decision",
      on the strength of 0 of 18 repos signing. That zero was never evidence against
      it — it is what a practice nobody has adopted yet looks like, and reasoning
      from it makes the gate ratify the status quo it exists to move. The rule that
      settled it (operator, 2026-08-13) asks something else entirely: would a public
      AAA+ repository do this?       Yes. Unlike the two legitimate conventions that
      killed VERSION-DRIFT, there is no second convention under which release tags
      are better left unattributable.

      The policy is a DATE, and the date is what made the check shippable.
      Measured across 20 clones before the rule was locked: 158 v* tags, 144
      annotated, 14 lightweight, 0 signed, and not one tag dated after 2026-08-12. A
      boolean "this org signs" would have failed 20 correct repositories the day it
      landed, with force-moving 144 published refs as its only remedy — the mechanism
      that gets gates switched off. tags_signed_from lives in the register, never
      in the engine (the rule that keeps the org-profile exemption a flag rather than
      a class name in a classifier); absent it, the check is a notRun SKIP, because
      the gate never assumes a policy nobody recorded.

      Verified both directions: a sweep of 21 repos yields 18 TAG-SIGNED-PREPOLICY

      • 3 TAG-SIGNED-NONE, 0 ERROR, 0 WARN — then, against real git objects, an
        unsigned post-policy newest tag does fire ERROR. A sweep returning zero
        proves nothing alone; a dead check returns zero too.

      Two exclusions keep one defect from being counted twice under two codes: a
      lightweight tag has no tag object to carry a signature at all
      (TAG-SIGNED-LIGHTWEIGHT, a byDesign skip naming TAG-ANNOTATED as the
      owner), and a pre-policy tag was correct when it was cut
      (TAG-SIGNED-PREPOLICY, an OK — said out loud, never as silence).

      It answers is this tag signed and never does the forge vouch for it: the
      signature is read from the clone, while the forge's "Verified" badge needs a
      key registered there.

    Changed

    • The engine reads tag signature and creation date alongside the object type, in
      the same single for-each-ref. The signature is read with
      %(if)%(contents:signature)%(then)… rather than by printing the block, which
      is multi-line and would break the line-oriented parser on exactly the tags the
      check cares about. No new API call — this stays at three.
    • 241 tests, from 230.
    Downloads