Commits

history of .gitbay/wiki/Threat-Model.org

• lfs: e2e for a token outliving its key; document the binding

  cmc · 2026-09-29 00:23 UTC

  Verified · cmc bd5cf5d7d1

• wiki: unkeyed audit chain, stall kill, enforced limits, pack-limit gaps

  cmc · 2026-09-28 22:56 UTC

  Verified · cmc 77ff123033

• backup: verify skips commondir; refs/ before packed-refs; tighter stale match

  cmc · 2026-09-28 22:38 UTC

  success Verified · cmc 8994b7770e

• backup: archive each repository's refs before its objects

  cmc · 2026-09-28 22:25 UTC

  Verified · cmc d201d6acb1

• wiki: backup verify, backup lock, restore drill procedure

  cmc · 2026-09-28 22:15 UTC

  Verified · cmc 55cbdaf81e

• runner: builds reach the forge at pasta's host address

  cmc · 2026-09-28 08:24 UTC

  Verified · cmc 24c714dba2

• wiki: what a build can reach

  cmc · 2026-09-28 07:35 UTC

  Verified · cmc 26e387e932

• wiki: trusted and untrusted build homes

  cmc · 2026-09-28 06:36 UTC

  success Verified · cmc 7b644421d3

• wiki: fix API token-refusal claim, batched-review status, watch/pin dispatch, login-link URL exception

  cmc · 2026-09-28 09:03 UTC

  success Verified · cmc 4ffdc2c645

• audit: refused pushes, journal copy, admin audit verify

  cmc · 2026-09-28 21:34 UTC

  success Verified · cmc 0666c9f622

• mirror: ignore operator gitconfig, require git 2.37; import SSRF gap documented

  cmc · 2026-09-28 08:52 UTC

  success Verified · cmc 298ac0b456

• mirror: check the address before each sync and pin git to it

  cmc · 2026-09-28 08:45 UTC

  Verified · cmc 869d5659fb

• wiki: delegation bound covers tokens and keys, not web sessions

  cmc · 2026-09-28 08:10 UTC

  success Verified · cmc e2a32d5f8d

• wiki: token delegation, read default; release note

  cmc · 2026-09-28 07:17 UTC

  success Verified · cmc 0787c7c07e

• wiki: revocation closes open connections

  cmc · 2026-09-28 06:44 UTC

  success Verified · cmc 4bbf4f8114

• wiki: architecture and security pages

  cmc · 2026-09-28 03:46 UTC

  success Verified · cmc 7a6343d02d

• control: drop SSHOnly, and put the accounts on the admin page

  cmc · 2026-09-19 20:33 UTC

  success Verified · cmc 000e6436f3

• runner: secrets with newlines reach the container through podman's environment

  cmc · 2026-09-10 02:58 UTC

  success Verified · cmc dab7e0ad06

• wiki: runners attached to repositories

  cmc · 2026-09-09 03:24 UTC

  Verified · cmc f9845abbc9

• runner, deploy, wiki: a build home per repository, and caps on the runner unit

  cmc · 2026-09-07 18:47 UTC

  success Verified · cmc 0caaaedf8f

• deploy, wiki: ProtectKernelTunables=no so a container can mount proc

  cmc · 2026-09-07 01:27 UTC

  failure Verified · cmc 7d675c19a7

• runner, deploy, wiki: images are provisioned, never pulled by a build

  cmc · 2026-09-07 00:27 UTC

  failure Verified · cmc 44c2c11f58

• deploy, wiki: NoNewPrivileges=no so rootless podman can start

  cmc · 2026-09-06 23:26 UTC

  failure Verified · cmc d6632e706a

• runner, ci, store, wiki: run build steps in a rootless podman container

  cmc · 2026-09-06 21:52 UTC

  success Verified · cmc 76668f2f38

• runner, wiki: give builds a home that outlives the build

  cmc · 2026-09-06 21:46 UTC

  success Verified · cmc 3d2795d9c2

• runner, wiki: construct the step environment instead of inheriting it

  cmc · 2026-09-06 18:44 UTC

  success Verified · cmc 3f7409ca2e

• wiki: record what the security sweep did not cover

  cmc · 2026-09-06 18:32 UTC

  success Verified · cmc aeedf75018

• notify, web, wiki: log dead-lettered mail by queue row, not recipient

  cmc · 2026-09-06 18:13 UTC

  success Verified · cmc f6981be6cb

• Add '.gitbay/wiki/' from commit '5593f9c1d6842ab10c228f7818320e13a00dff95'

  cmc · 2026-09-05 06:20 UTC

  success Verified · cmc 00033f022f