Verify signed skill bundles before extraction (#734)

mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-11 21:57:14 +03:00

* Verify signed skill bundles before extraction

Sign release ZIPs locally with an Ed25519 key from 1Password and pin the public trust root in the Rust installer. Reject unauthenticated downloads before extraction and preserve existing installs on failure. Document the signature-first rollout and explicit local trust paths.

AI-assisted implementation prepared by Codex at Paul Bakaus’s request.

* Fix signed-bundle review guardrails

Make keyring loading failures fatal before any download, accept standard release redirect statuses while retaining URL pinning, and require the signature sidecar before tagging. Add regressions for all three review findings.

AI-assisted changes prepared and tested by Codex at Paul Bakaus’s request.

This commit is contained in:

Paul Bakaus

2026-09-04 18:21:01 -07:00

committed by

GitHub

parent 46ffe5caa2

commit 8dac6ae7e0

16 changed files with 800 additions and 6 deletions

Cargo.lock

Generated

View File

@@ -698,6 +698,8 @@ dependencies = [
  "libc",
  "once_cell",
  "regex",
  "ring",
  "serde",
  "serde_json",
  "sha2",
  "ureq",