OXYGENHUB

Changelog: a server can refuse a push by what it adds (oxygenhub#268) 27825564bc16

Author
Andy McCall @andymccall <[email protected]>
via
agent agent:claude@andymccall <[email protected]> · keyless, under your grant for changes,refs,seal · key 09af59508e90
When
· 2026-10-19 20:58 UTC
Signature
◈ sealed by agent:claude@andymccall
Hash
27825564bc16ea9d7fda6599b3029004a155181009b24320fb77e63ec6e7e154
Depends on
8fd78eb52ad2 e4595038502a
Depended on by
2b95bc24d7d6
In bookmarks
identical-sides keyless-tags main push-notes subrepo-pin-state
In tags
v0.10.0 v0.11.0 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
Edits
1 atom, 0 tree operations, 1 file

Browse the tree at this change

hide whitespace changes
modified CHANGELOG.md +2 −0
… 
1 unchanged lines
2 2 

    

  
    

      3
      3
       
      
## Unreleased

    

  
    

      4
      4
       
      

    

  
    

      
      5
      +
      
- **A server can refuse a push by what it adds (oxygenhub#268).** `oxy-server`'s `Backend` has a `vet_push` step, called with the push's changes before anything is stored or moved; OxygenHub uses it for push protection (secret scanning). The refusal reaches `oxy push` as the server's own text, several lines included, and a refusal that mentions a certificate or a timeout no longer picks up a misleading hint.

    

  
    

      
      6
      +
      

    

  
    

      5
      7
       
      
- **Fetch checks the hub's transparency log (oxygenhub#238).** A hub that keeps a log sends its latest checkpoint with every refs answer, and each bookmark's attestation with its log entry and inclusion proof. The first fetch pins the hub's log key in `<oxy home>/tlog/<hub>` with the last checkpoint seen. A later checkpoint must be signed by that key and extend the last one: a smaller log, another root at the same size or a failed consistency proof fails the fetch, saying the hub showed two histories. An attestation not logged yet, or not proved, is only a note for now, printed by `fetch` and `pull` and in `--json`. A hub that comes back with a new log key (a new key, a reused address, a rename) is a loud note, and the new key is pinned. Older hubs and clients ignore the new fields.

    

  
    

      6
      8
       
      

    

  
    

      7
      9
       
      
- **`oxy tlog verify` audits a hub's whole log (oxygenhub#238).** It accepts the hub's checkpoint by the same rules as fetch, downloads every entry and requires them to make the root the checkpoint signs, then lists this repository's entries, a key's (`--key`) or all of them (`--all`); `--json` too. It also shows which witnesses cosigned and when.

    

  
    

      
      
      …
      
242 unchanged lines