[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
jdx/packslip	action	patch	v1.11.1 → v1.11.2	v1.11.3

---

Release Notes

jdx/packslip

v1.11.2: : Detect replaced public keys that reuse the old key ID

Compare Source

packslip install now asks for approval when a key-signed project switches to a different public key that keeps the old key ID. This release also puts limits on how much work a hostile bundle can force the verifiers to do, and fixes two argument-handling gaps in the GitHub Actions. The format and specification are unchanged.

Fixed

• packslip install treats a replacement public key with the same key ID as a trust change. A minisign key ID is eight bytes of text in the public key file. It is not derived from the key itself. Before this release, the continuity check compared only that ID, so a different key with the old ID was accepted through --pubkey or pins.d without approval, and install then remembered the new key. Each key-signed record now also stores a fingerprint of the whole public key. A changed key is reported as public key changed from <old> to <new> and needs --accept-trust-change=<id> like any other trust change. That means one approval for the release list and one for the release, as the trust guide already described. Records for keyless projects are unchanged. (#​305, @​jdx)
  • Existing histories: On the first install after you upgrade, records without a fingerprint are filled in from the public key the history already remembers, so that install catches a same-ID replacement. If a history has a key-signed record but no remembered key, it adopts the first key it sees, as before. If an earlier version already accepted a same-ID replacement for the release list, the old key is lost and cannot be recovered. In that case the release check uses the replacement key as its baseline and does not catch the swap. Older packslip versions ignore the new field.
  • Pending approvals: If a key change was waiting for approval when you upgraded, its approval ID changes. Approve it again with the new ID.
• Verifiers reject oversized or malformed bundle data before doing expensive work. (#​304, @​jdx)
  • The standalone verifier (verifier/packslip-verify.mjs) rejects inclusion proofs whose logIndex or treeSize is not a non-negative int64. Before, a very long digit string took time that grew quadratically with its length. It also rejects checkpoints with more than 16 signatures.
  • The JavaScript package rejects bundles with more than 8 transparency-log entries or RFC 3161 timestamps before passing them to sigstore, which compares them pairwise before authenticating any. A normal release bundle has one entry.
  • In the Go library, Statement.Validate now finds artifacts with the same selectors in linear time. Before, the check was quadratic in the number of artifacts.
• GitHub Actions handle unusual artifact names and tags safely. (#​304, @​jdx)
  • The jdx/packslip action now passes -- before the artifact list. An artifact whose file name is exactly a packslip option, such as --no-pin-workflow, was previously read as that option. It is now treated as an artifact, and packslip create refuses it because it has no format.
  • The releases action now fails on a tag directory containing =. --release URL=PATH splits at the first =, so a tag like that moved part of the URL into the path.

Full Changelog: jdx/packslip@v1.11.1...v1.11.2

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

This PR does not match any of the 1 configured review trigger rule.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: de479de8-e9c2-418d-80e1-ed8644d8f635

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn