harald/sanctum
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases 12 Wiki Activity
79 Commits 1 Branch 12 Tags
8dd54494b0f2bbbe03e6faaf714df95f5e1427f6
Commit Graph
4 Commits
Author SHA1 Message Date
harald 8dd54494b0 fix(upgrade): U-02 — validate version in minisign trusted comment against release tag 2026-09-19 09:43:39 +02:00
harald 78a9c233f8 fix(upgrade): U-01 — enforce pre-hashed minisign verification 2026-09-19 09:41:29 +02:00
harald fba7f305e3 release: v0.7.2 — Security Audit Remediation (SA-01 bis SA-07)
Sanctum Release / Build & Test (Windows x86_64) (push) Waiting to run
Details
Sanctum Release / Sign & Release (push) Blocked by required conditions
Details 
- SA-01: Container-DoS / KDF-Amplification Schutz mit Pre-KDF Validierung, max 2 Slots (nur 0 und 1), Slot 0 Pflicht und strikten BLOB-Laengen
- SA-02: Release-Signierung in CI entkoppelt (getrennte build und sign-and-release Jobs, Secret-Isolation)
- SA-03: Pinned Download-Integritaet fuer minisign.exe in CI via SHA-256
- SA-04: Immutable Action-Pinning (@sha) und Toolchain-Pinning (1.85.0) in CI
- SA-05: Session-Token vollstaendig aus URIs verbannt (403 Forbidden bei Vorkommen im Pfad/Query)
- SA-06: Constant-Time Token- und Auth-Vergleiche via subtle::ConstantTimeEq
- SA-07: Dokumentations-Klarstellung bzgl. logischem Shredding vs. physischer SSD/FTL/CoW-Persistenz
 2026-09-18 23:40:35 +02:00
harald 436790abf0 feat(security): release v0.7.0 with comprehensive security hardening (S-01 to S-11)
Sanctum Release / Build & Release (Windows x86_64) (push) Waiting to run
Details
2026-09-18 19:12:43 +02:00