harald/sanctum
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases 12 Wiki Activity
70 Commits 1 Branch 12 Tags
17ac4f9358a0baaac8d81252636a1dad20ba25be
Commit Graph
4 Commits
Author SHA1 Message Date
harald 36a4094336 fix(crypto): K-02 — format v3 chunk replay protection with generation aad 2026-09-19 00:52:13 +02:00
harald ad531d8393 fix(crypto): K-01 — format v3 canonical metadata authentication 2026-09-19 00:26:27 +02:00
harald fba7f305e3 release: v0.7.2 — Security Audit Remediation (SA-01 bis SA-07)
Sanctum Release / Build & Test (Windows x86_64) (push) Waiting to run
Details
Sanctum Release / Sign & Release (push) Blocked by required conditions
Details 
- SA-01: Container-DoS / KDF-Amplification Schutz mit Pre-KDF Validierung, max 2 Slots (nur 0 und 1), Slot 0 Pflicht und strikten BLOB-Laengen
- SA-02: Release-Signierung in CI entkoppelt (getrennte build und sign-and-release Jobs, Secret-Isolation)
- SA-03: Pinned Download-Integritaet fuer minisign.exe in CI via SHA-256
- SA-04: Immutable Action-Pinning (@sha) und Toolchain-Pinning (1.85.0) in CI
- SA-05: Session-Token vollstaendig aus URIs verbannt (403 Forbidden bei Vorkommen im Pfad/Query)
- SA-06: Constant-Time Token- und Auth-Vergleiche via subtle::ConstantTimeEq
- SA-07: Dokumentations-Klarstellung bzgl. logischem Shredding vs. physischer SSD/FTL/CoW-Persistenz
 2026-09-18 23:40:35 +02:00
harald 436790abf0 feat(security): release v0.7.0 with comprehensive security hardening (S-01 to S-11)
Sanctum Release / Build & Release (Windows x86_64) (push) Waiting to run
Details
2026-09-18 19:12:43 +02:00