Release CodeTruss CLI v0.2.44 - #37
Merged
Merged
Conversation
Syncs the 0.2.44 source from the private monorepo. codetruss-cli-0.2.44.tgz sha256 8a405b77b2042c8daca6f2def782fa8e38a2ffcec4ebe9643631d3491af50884 That is the digest the website serves and the digest in release-reference.json, rebuilt from this tree and compared rather than copied across. 0.2.44 makes a receipt checkable by the person it was handed to. `verify` only ever measured a receipt against the signing keys the local `.codetruss.yml` pins, so the client or auditor the evidence was written for could not check it at all; `verify-receipt <receipt.json|dir>` checks it outside any repository and keeps integrity and provenance as separate claims. Documentation already tells readers to run it, and until this release no install channel served it. No dependency moves: package.json, pnpm-lock.yaml, pnpm-workspace.yaml, and .npmrc are untouched, and public/downloads/grammars/ is carried verbatim. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the 0.2.44 source from the private monorepo, byte for byte against the monorepo git objects (198 files compared by blob hash, 0 mismatches).
That is the digest the website serves today and the digest now in
release-reference.json. It was not copied into the reference:pnpm release:artifactwas run against this tree and the rebuilt archivecmps clean against bothcodetruss.com/downloads/codetruss-cli-0.2.44.tgzand the monorepo's copy.What 0.2.44 is
codetruss verifyonly ever measured a receipt against the signing keys the local.codetruss.ymlpins, so the client, auditor, or acquirer a receipt was written for could not check it — they gotreceipt signer <fp> does not match trusted key <fp>and stopped.codetruss verify-receipt <receipt.json|dir>checks a receipt outside any repository, needing nothing but the files, and reports integrity and provenance as two separate claims rather than merging them. A receipt vouching for its own key proves nothing about who wrote it, so a run without an out-of-band--public-keyexits1(intact but unattributed); altered bytes exit2.This is release-blocking rather than routine: published documentation already tells readers to run
verify-receipt, and no install channel serves it until this tag exists.Not touched
package.json,pnpm-lock.yaml,pnpm-workspace.yamland.npmrcare unchanged — 0.2.44 moves no dependency.public/downloads/grammars/is carried verbatim, and no previously published artifact is modified.Checked locally before opening
pnpm typecheck,pnpm test(34 files, 425 tests),pnpm release:artifact,pnpm release:verify, andpnpm test:installall pass against this branch. The rebuilt archive reproduced8a405b77…exactly, and--helpon the built bundle listsverify-receiptwhere the 0.2.43 bundle does not.🤖 Generated with Claude Code