cc37b86627b3 | Merge smallrows/qxml2-exclusions into master (lane SMALL-ROWS): pom exclusions no longer overwrite the dependency's coordinate (QXML-2) | 2026-10-29 |
834d76fd070b | GREEN znippy-plugin-maven pom: only a <dependency>'s own children make its coordinate (QXML-2) | 2026-10-29 |
f57bf1ae08de | RED znippy-plugin-maven pom: an <exclusion> overwrites its dependency's groupId/artifactId (QXML-2) | 2026-10-29 |
c410c1681abd | Merge qxml/quick-xml-0.41 into master (lane QXML): znippy-plugin-maven 0.10.1 on quick-xml 0.41 (RUSTSEC-2026-0194/-0195) | 2026-10-29 |
12b8b79783a9 | GREEN znippy-plugin-maven 0.10.1: quick-xml 0.36 -> 0.41 (RUSTSEC-2026-0194, RUSTSEC-2026-0195) | 2026-10-29 |
9c148549c4e3 | RED znippy-plugin-maven: pom parsing must build on quick-xml with the RUSTSEC-2026-0194/-0195 fixes | 2026-10-29 |
13eb229d5f85 | Merge pub/plugin-git-0.2.1 into master (lane PUB-R5H2): znippy-plugin-git 0.2.1, lock follows the sibling mains | 2026-10-28 |
544f3134509e | znippy-plugin-git 0.2.1: the FORGE-SHALLOW header-probe fix as a publishable version; the lock follows the sibling mains | 2026-10-28 |
22a24fc26abb | Merge fix/forge-shallow-2026-10-28 into master (lane NIGHT-FORGE): FORGE-SHALLOW, a header probe is clamped at the archive end, so a short thin ref-delta that is the last entry of the archive no longer fails header() with a short read (git.gunnar.rs edda 25e2859: every shallow clone and by-id fetch). RED fff68fd, GREEN 1e0fb65. znippy-plugin-git lib 303/5 (master's own 5: io_uring ENOSYS x4, a_bounded_base_set), clippy --no-deps clean on the touched lines. Not published: znippy-plugin-git 0.2.1 is the next publish row. | 2026-10-28 |
1e0fb6557898 | GREEN: a header probe is clamped at the archive end (FORGE-SHALLOW) | 2026-10-28 |
fff68fdf2fa2 | TEST: header() of a short ref-delta at the archive end (FORGE-SHALLOW; RED: short read at (65, 64)) | 2026-10-28 |
94f87acd6c24 | Merge fix/small-4-2026-10-25 into master: no file addresses our repositories on the old forge (A28 N7-left) | 2026-10-25 |
aec0c4f0f4f0 | GREEN: CLAUDE.md names znippy's real home (A28 N7-left; guard 4/0; docs only) | 2026-10-25 |
23db1217500a | TEST: no file addresses our repositories on the old forge (A28 N7-left; RED: CLAUDE.md:6) | 2026-10-25 |
671d3c3ed0f1 | Merge v2/n7-a28-small-2026-10-25: every repository = names this repository's real home, with a guard test (A28 L17) | 2026-10-25 |
fbcd3fc8ced7 | GREEN: every repository = names this repository's home (A28 L17) | 2026-10-25 |
b3ed4693e741 | RED: every Cargo.toml names this repository's real home and none names the old forge (A28 L17) | 2026-10-25 |
c2d92b506592 | Merge fix/dsse-fulcio-chain-2026-10-24 into master: znippy-common 0.10.1 — a DSSE signer chains through intermediates to a trust anchor, ECDSA SHA-384 and P-384 (Fulcio); Chainguard's real cosign attestation verifies (tests/dsse_fulcio_chain 2/0, sign:: 30/0, znippy-common --features sign 145/0) | 2026-10-24 |
956608930083 | Cargo.lock: znippy-common 0.10.1 with p384 0.14.0 (already in the lock) | 2026-10-24 |
c4e17d314818 | sign: verify_digest takes signature 3's closure form; dsse_fulcio_chain 2/0, sign:: 30/0 (Chainguard's real cosign attestation chains leaf -> Sigstore intermediate -> root; root alone refused; tampered refused) | 2026-10-24 |