Migrate to ATRAPS LLC: copyright, metadata, trusted publishing - #1
Merged
Conversation
The IFPS VM adds branch deltas to the current position in wrapping Cardinal arithmetic, so a backward jump is encoded as a large unsigned delta. `branch_target()` / `branch_targets()` used a checked add and returned None for every backward conditional branch, losing the back edge of every loop, while the disassembly display saturated to 0xffffffff. Unify the four copies of the branch-delta arithmetic onto a single `relative_target` helper so goto and condgoto cannot disagree about the same wire delta. Rebase `flaggoto` and PushExceptionHandler targets, which are procedure-local, onto the proc's bytecode_offset so a listing no longer mixes two coordinate systems. Release 0.1.2.
Record ATRAPS LLC as copyright holder following the executed IP assignment. The Apache-2.0 appendix previously named Johann Kempter personally and carried the wrong year: every commit in this repo dates to 2026, not 2025. - LICENSE: appendix now reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; point `repository` at the org - README: name the holder in the license section Hosting and package-owner moves follow separately; this commit is the on-record ownership statement.
Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. The trust is bound to the repository and workflow rather than to a personal crates.io account, so publish rights belong to the org's repo. Also gate the job on the release commit being contained in main. The `release: published` trigger alone does not imply that: a release can be cut from any commit, including one that never landed on main. target_commitish is not usable for this — it holds either a branch name or a sha depending on how the release was created, and neither proves containment — so use merge-base with full history.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration of this crate to ATRAPS LLC ownership, per TRANSFER.md.
fix:— backward branch targets resolved and absolute targets rebased (unreleased 0.1.2 work that was already in the tree).chore:— the ownership change, isolated to one diff:LICENSEappendix now readsCopyright 2026 ATRAPS LLC. It previously named Johann Kempter personally and said 2025, which no commit in this repo supports — the history is entirely 2026.NOTICEadded (Apache-2.0 §4(d) attribution channel).Cargo.toml: dropped the deprecatedauthorsfield;repositoryrepointed at the org.README: names the holder in the license section.ci:— publishing moved to crates.io trusted publishing. The long-livedCARGO_REGISTRY_TOKEN(a personal-account token) is replaced by a short-lived OIDC token bound to this repo and workflow. The job additionally refuses to publish a release whose commit is not contained inmain, sincerelease: publishedalone does not guarantee that.Verified locally: 44 tests pass, clippy clean, fmt clean,
cargo package --listshipsNOTICE.