OXYGENHUB

Releases 1

OxygenHub 0.9.11 v0.9.11 · ✔ signed by Andy McCall · andymccall ·

Trust and audit

  • Your sky over the API (oxygenhub-android#23). GET /api/v1/user/sky gives what the dashboard's backdrop draws: the caller's repositories and their pushes, proposal and issue events, releases and Flow runs of the last 30 days, so the Android app draws the same sky from the same data.

  • Another repository's pass is taken only on its signed receipt (issue #296). A pass from upstream or from any other repository on the hub now stands only if its runner's signed receipt was kept (the hub checks it against the runner's bound key when the job finishes) and, read again from that repository's store, still verifies and its key is not revoked; otherwise the job runs here. Only a pass that ran in the repository offering it is taken, so the receipt is where it is checked.

  • A pass on the same state is reused from any repository on the hub (issue #296). After the repository's own runs and the line it was forked from, a push's job with no pass of its own on that state reuses one from any other repository holding the same state, public or with the same owner, newest first: a state is its changes, so whoever proved it, the proof holds. The run page and the check say whose pass it was.

Assets