Make a check that could not look say so, everywhere it can happen - #3

Merged

HackingGate merged 21 commits into

mainfrom

fix/audit-findings

Aug 12, 2026

Commits on Aug 12, 2026

Read the paths and the messages a guard publishes, not only the blobs
HackingGate
committed
2d42d52
Select from what git tracks, and hand the exec the bytes it was given
HackingGate
committed
9b0b69e
Make the clean answer reachable for audit --for-publication
HackingGate
committed
6b3f783
Ask both pin questions of one answer, and exit 2 where neither fits
HackingGate
committed
66204df
Read the seams a repository publishes, not the ids it happens to pin
HackingGate
committed
c09ca8c
Fire the seams CI pins and never exercises
HackingGate
committed
93d1140
Describe the seams as they now behave
HackingGate
committed
9430f17
Drain the pipe before waiting on what fills it
HackingGate
committed
2ca06f5
Stop the pin walk at a boundary, and at an error
HackingGate
committed
7335700
Separate "nothing is declared not-text" from "nobody could ask"
HackingGate
committed
ed75694
Refuse the editor path this shim cannot stand in front of
HackingGate
committed
ed18867
Say what an inherited shim and a blank checker entry do
HackingGate
committed
a21cfdb
Refuse a malformed inherit list, and read a remote as one entry
HackingGate
committed
6c9e538
Describe an unreadable file as could-not-look
HackingGate
committed
218fc89
Report a fetch that failed, the way the comment said it did
HackingGate
committed
fc3edd4
Recognise a remote that names this repository without an owner
HackingGate
committed
83a54bf
Reject a remote that is somebody else's, not one that is anonymous
HackingGate
committed
56d1157
Stop naming a runner's home directory while explaining not to
HackingGate
committed
95e94aa
Stop reading a shared build account as somebody's identity
HackingGate
committed
54ef042
Ask the identity corpus a question that does not depend on who runs it
HackingGate
committed
caa9240
Refuse a literal owner in every variant, not only the first
HackingGate
committed
8b81ed3

Navigation Menu

Make a check that could not look say so, everywhere it can happen - #3

Make a check that could not look say so, everywhere it can happen#3
HackingGate merged 21 commits into
mainfrom
fix/audit-findings

Commits on Aug 12, 2026

Read the paths and the messages a guard publishes, not only the blobs

Select from what git tracks, and hand the exec the bytes it was given

Make the clean answer reachable for audit --for-publication

Ask both pin questions of one answer, and exit 2 where neither fits

Read the seams a repository publishes, not the ids it happens to pin

Fire the seams CI pins and never exercises

Describe the seams as they now behave

Drain the pipe before waiting on what fills it

Stop the pin walk at a boundary, and at an error

Separate "nothing is declared not-text" from "nobody could ask"

Refuse the editor path this shim cannot stand in front of

Say what an inherited shim and a blank checker entry do

Refuse a malformed inherit list, and read a remote as one entry

Describe an unreadable file as could-not-look

Report a fetch that failed, the way the comment said it did

Recognise a remote that names this repository without an owner

Reject a remote that is somebody else's, not one that is anonymous

Stop naming a runner's home directory while explaining not to

Stop reading a shared build account as somebody's identity

Ask the identity corpus a question that does not depend on who runs it

Refuse a literal owner in every variant, not only the first