Land keyless release tags (oxygen#129) and the history scan (#277); pin oxygenflow 84077bcd ea55fb62f919 resolution
Merges the hub's halves of oxygen#129 (a tag's acceptance logged and served with its log place) and #277 (history scan, removing an allowed fingerprint, backups.rs example keys built at run time), keeping all three Unreleased lines, and pins oxygenflow with oxygen#129. All four runners run flow 84077bcd first.
- Author
- Andy McCall @andymccall <[email protected]>
- via
- agent
agent:claude@andymccall <[email protected]> · keyless, under your grant for changes,refs,seal · key 5dd5040d43a5
- When
- · 2026-10-20 09:49 UTC
- Signature
- ◈ sealed by agent:claude@andymccall
- Hash
ea55fb62f9197f55862753612441467a6f1598cf418867be0fae48736ac803b8- Depends on
- 3571c519ada6 380996db84e5 9c04c779f032 a7e6e8e6094c b5668108487f b5c199bd6b1a cb7b3cd45dc0
- Depended on by
- 4c77a1c8aad8 d366306dae7d 166f6e9bf4f1 c7067c7bda56
- In bookmarks
- api-unknown-fields diffusion-pin-bookmark draft-ready main proposal-list-fast
- In tags
- v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
- Edits
- 3 atoms, 0 tree operations, 2 files
Browse the tree at this change
modified CHANGELOG.md +4 −5
| … | 3 unchanged lines |
||
| 4 | 4 | ||
| 5 | 5 | ## Unreleased |
|
| 6 | 6 | ||
| 7 | - | <<<<<<< oxy conflict 1 of 1, side 1 of 3: change 8c306635 "Proposal lists without rendering every diff; each file's lines computed once" |
|
| 8 | - | - **Proposal lists and the proposals API are much faster on large files:** listing a repository's proposals rendered every open proposal's full diff and looked up each new line's history separately, recomputing a whole file's lines for every line; lists, the API, auto-land and the checks after a push now skip the rendering, and the proposal page computes each file's lines once. |
|
| 9 | - | ======= oxy conflict 1 of 1, side 2 of 3: change 5c7a43e0 "Keyless agents' release tags: log and serve a tag's acceptance and log place" |
|
| 10 | - | - **Keyless agents can push release tags (andymccall/oxygen#129):** A tag signed by a key the hub certified (an agent's or a Flow job's ten-minute key) was refused "unknown key", and then refused by the policy. With oxy's fix the hub accepts it under the policy's subject grant and countersigns when it accepted it, as it does a bookmark move. It logs the tag's acceptance in the transparency log beside the tag, and serves both with the tag in every refs answer, so a client fetching the tag months later checks the certificate at the hub's time. Runners read repositories with their own oxy, so they need rebuilding to check such tags; older ones ignore the new fields. |
|
| 11 | - | ||
| 7 | + | - **Proposal lists and the proposals API are much faster on large files:** listing a repository's proposals rendered every open proposal's full diff and looked up each new line's history separately, recomputing a whole file's lines for every line; lists, the API, auto-land and the checks after a push now skip the rendering, and the proposal page computes each file's lines once. |
|
| 8 | + | - **Keyless agents can push release tags (andymccall/oxygen#129):** A tag signed by a key the hub certified (an agent's or a Flow job's ten-minute key) was refused "unknown key", and then refused by the policy. With oxy's fix the hub accepts it under the policy's subject grant and countersigns when it accepted it, as it does a bookmark move. It logs the tag's acceptance in the transparency log beside the tag, and serves both with the tag in every refs answer, so a client fetching the tag months later checks the certificate at the hub's time. Runners read repositories with their own oxy, so they need rebuilding to check such tags; older ones ignore the new fields. |
|
| 9 | + | - **Secret scanning finds what is already in history (#277):** push protection's rules now also run over each repository's existing history in the background (every change reachable from its bookmarks: the lines it inserts and the text files it replaces), so a credential committed before push protection existed, or while it was off, is found too. Every repository's whole history is scanned once after this deploy, then only what each push adds, a budget at a time (`[limits] history_scan_limit`, 64 MiB, and `history_scan_time_ms`, 5 s, per repository per pass; `0` turns it off), at low priority, resuming where it stopped. Maintainers see the findings, with the change, bookmark, file and line, under Settings › Push protection › Found in history, and either allow one (not a secret) or mark it resolved with how it was revoked (audited as `secret.resolved`); "Scan history now" scans the whole history again. An allowed fingerprint can now be removed (audited as `secret.bypass_removed`), so pushes adding that value are refused again. Repositories with push protection off are not scanned. |
|
| 10 | + | ||
| 12 | 11 | ======= oxy conflict 1 of 1, side 3 of 3: change 6738590b "Secret scanning: scan existing history, remove an allowed fingerprint" |
|
| 13 | 12 | - **Secret scanning finds what is already in history (#277):** push protection's rules now also run over each repository's existing history in the background (every change reachable from its bookmarks: the lines it inserts and the text files it replaces), so a credential committed before push protection existed, or while it was off, is found too. Every repository's whole history is scanned once after this deploy, then only what each push adds, a budget at a time (`[limits] history_scan_limit`, 64 MiB, and `history_scan_time_ms`, 5 s, per repository per pass; `0` turns it off), at low priority, resuming where it stopped. Maintainers see the findings, with the change, bookmark, file and line, under Settings › Push protection › Found in history, and either allow one (not a secret) or mark it resolved with how it was revoked (audited as `secret.resolved`); "Scan history now" scans the whole history again. An allowed fingerprint can now be removed (audited as `secret.bypass_removed`), so pushes adding that value are refused again. Repositories with push protection off are not scanned. |
|
| 14 | 13 | ||
| … | 256 unchanged lines |
replaced deps/oxygenflow +0 −0
No line changes.