Skip to content

docs: record v2.2.0 release provenance #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cdeust merged 1 commit into from
Aug 3, 2026
Merged

docs: record v2.2.0 release provenance #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .bestpractices.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,8 +134,8 @@
"implement_secure_design_justification": "The assurance case maps least privilege, economy of mechanism, complete mediation, fail-safe artifact handling, transparent host boundaries, and defence in depth to implemented controls: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md#3-secure-design-principles",
"crypto_used_network_status": "N/A",
"crypto_used_network_justification": "The shipped runtime intentionally makes no network request; it processes host events and local files. CI and release publication use GitHub HTTPS but are not runtime network protocols implemented by the software: https://github.com/cdeust/session-optimizer/blob/main/PRIVACY.md",
"signed_releases_status": "Unmet",
"signed_releases_justification": "The release workflow can publish Sigstore provenance attestations for the source bundle, executable manifest, and SBOM, but it has not yet produced a public tagged release. SECURITY.md explicitly keeps this criterion unmet until a new tag completes and is independently verified: https://github.com/cdeust/session-optimizer/blob/main/SECURITY.md#verifying-a-release",
"signed_releases_status": "Met",
"signed_releases_justification": "Release v2.2.0 publishes SHA-256 checksums and GitHub Sigstore build-provenance attestations for the source bundle, executable manifest, and SBOM. The release workflow completed successfully and the downloaded asset digests match their published checksum files: https://github.com/cdeust/session-optimizer/releases/tag/v2.2.0",
"input_validation_status": "Met",
"input_validation_justification": "Host JSON, transcript shapes, paths, checksums, archive members, and executable manifest entries are parsed or allowlisted at their boundaries. Regression tests include malformed hook events, whitespace-bearing valid JSON, unsafe archive paths, and tampered artifacts; the assurance case records the limits: https://github.com/cdeust/session-optimizer/blob/main/docs/ASSURANCE-CASE.md",
"hardening_status": "Unmet",
Expand Down