OXYGENHUB

Releases 1

OxygenHub and oh 0.6.1 v0.6.1 · ✔ signed by Andy McCall · andymccall ·

Trust and audit
  • Tidier forms and headers: the New drop page is laid out like every other page (it ran the full width when its notice did), a form's Cancel lines up with its buttons (drops and web edits), and the Drops page's + NEW DROP sits beside its title instead of against the text above.
  • Released oxy can clone repositories with an agent's release tag again (oxygen#131): since keyless agents could tag releases with ten-minute certified keys, oxy 0.5.0 and older refused such a tag when cloning or fetching a repository with a trust policy (key … may not create tags/v0.5.0 under this repository's policy), and with it the whole clone, so andymccall/oxygen could not be cloned by any released client. The hub now leaves those tags out of its answer to a client that does not declare certified-tags in the new Oxy-Features request header (oxygen#131), which sees the repository as if the tag did not exist; current clients get it as before. Needs the oxygen pin with oxygen#131.
  • Drops: snippets of files, each its own small repository (issue #279): a drop is one or more files, as a gist is, kept as an Oxygen repository of its own at /{owner}/drops/{id} (a 24-hex-digit id), so every edit is a signed change with history and diffs, and oxy clone and oxy push take its address. Make one at /drops/new (title, description, files, public or secret), with POST /api/v1/drops, or with oh drop create FILE… [--secret] [-d TEXT] [-t TITLE]; the hub commits it as your delegate, as web edits are, so you delegate to the hub's key first. Your Drops page (/drops, under your profile and in the site band) lists and manages them; someone else's shows their public drops only. A secret drop is listed nowhere but readable by anyone with its address. Drops never appear among repositories (profiles, the dashboard, Explore, search, GET /api/v1/repos); Admin › Storage labels them. Only the owner edits a drop; the owner or a site administrator deletes it. Push protection covers drop pushes and what the web and the API commit. API: GET/POST /drops, GET /users/{name}/drops, GET/PATCH/DELETE /drops/{id}; oh drop list|view|delete. drops is now a reserved name, for owners and for repositories. Not yet: forks, stars, comments, embedding, and drops in backups.
  • Repository settings are one page per setting (issue #278): a repository's Settings was one long page; it is now a sidebar of grouped pages (General, Code, Flow, Integrations, Data, Danger zone) with the page shown beside it, the current one marked, each at its own address (/{owner}/{name}/settings/push-protection, /settings/runs, …; /settings is General). Pages a role cannot use are not listed and are not found. Every form keeps its address and now returns to its own page with what happened, so reloading does not send it again. Links elsewhere point at the new pages (the push protection refusal names /settings/push-protection), and a kept /settings#section link opens the page that has it. On a narrow screen the sidebar becomes a compact list above the page. An archived repository's settings open for its admins again, so they can bring it back.
  • Proposal lists and the proposals API are much faster on large files: listing a repository's proposals rendered every open proposal's full diff and looked up each new line's history separately, recomputing a whole file's lines for every line; lists, the API, auto-land and the checks after a push now skip the rendering, and the proposal page computes each file's lines once.
  • Keyless agents can push release tags (andymccall/oxygen#129): A tag signed by a key the hub certified (an agent's or a Flow job's ten-minute key) was refused "unknown key", and then refused by the policy. With oxy's fix the hub accepts it under the policy's subject grant and countersigns when it accepted it, as it does a bookmark move. It logs the tag's acceptance in the transparency log beside the tag, and serves both with the tag in every refs answer, so a client fetching the tag months later checks the certificate at the hub's time. Runners read repositories with their own oxy, so they need rebuilding to check such tags; older ones ignore the new fields.
  • Secret scanning finds what is already in history (issue #277): push protection's rules now also run over each repository's existing history in the background (every change reachable from its bookmarks: the lines it inserts and the text files it replaces), so a credential committed before push protection existed, or while it was off, is found too. Every repository's whole history is scanned once after this deploy, then only what each push adds, a budget at a time ([limits] history_scan_limit, 64 MiB, and history_scan_time_ms, 5 s, per repository per pass; 0 turns it off), at low priority, resuming where it stopped. Maintainers see the findings, with the change, bookmark, file and line, under Settings › Push protection › Found in history, and either allow one (not a secret) or mark it resolved with how it was revoked (audited as secret.resolved); "Scan history now" scans the whole history again. An allowed fingerprint can now be removed (audited as secret.bypass_removed), so pushes adding that value are refused again. Repositories with push protection off are not scanned.

Assets