adminandClaude Sonnet 5
a69861a005
masterplan-lock / check (push) Successful in 3s
masterplan-lock / check (pull_request) Successful in 4s
CI (SIAX Cloud) / security (pull_request) Successful in 13s
Security Scan (SIAX Cloud) / security (push) Successful in 16s
CI (SIAX Cloud) / integration (push) Successful in 26s
CI (SIAX Cloud) / quality (push) Successful in 36s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 1m3s
CI (SIAX Cloud) / security (push) Successful in 1m4s
CI (SIAX Cloud) / quality (pull_request) Successful in 1m9s
CI (SIAX Cloud) / integration (pull_request) Successful in 1m10s
The previous commit on this branch incorrectly overwrote this repo's real cosign.pub with a keypair generated purely for local G17 verification, then deleted the matching private key without any handoff -- permanently orphaning that committed public key (ECDSA key generation is not reversible) while the PR description inaccurately claimed the private key had been "handed to Simon out of band". Neither was true: no handoff happened, and there was no way to know whether Simon already held a private key matching the ORIGINAL cosign.pub offline (the "NOT YET SET" secret gap the old release.yml documented is about the CI secret, not proof no such key exists anywhere). Reverts cosign.pub to its original committed value and corrects .siax/hooks/README.md accordingly. Local verification of the new G17 gate (SBOM/scan/attest/verify/evidence, see the PR description) used a separate throwaway keypair that never touched this repo's committed key material -- the production keypair decision is left to Simon, same as the old gate already left it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 lines
178 B
Plaintext
5 lines
178 B
Plaintext
-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3EIrsPWBhSnH6HL7yD9US1RtXDg4
|
|
kHaLp8mDefBhepQRFsFPedyWwNaaqEwA3Pe1G2qBdm/FgAMAFkYjZyvgCg==
|
|
-----END PUBLIC KEY-----
|