Conversation
…m env (#82) Prompted by the broken v1.4.0 (signed by the org key while the installer still pinned the retired one — no gate caught it before publish). - New verify step in release.yml: after signing each artifact, extract the pinned public key from setup-agent.sh / update-agent.sh / internal/update/mod.rs, assert the three agree, and verify the .sig against it. A signature a freshly-pinned installer would reject fails the build before anything is uploaded. Tested locally: passes on the real v1.4.1 asset with the current pin, fails against the old key. - sign.py now reads GLYNDOR_RELEASE_ED25519_KEY from the environment instead of argv, so the signing key never appears in the runner's process table. Note: release.yml only runs on a tag, so PR CI does not exercise it — the verify logic and pin extraction were validated locally against the published v1.4.1 assets. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
The Dependabot config asked for a `dependencies` label, which predates the `type:/prio:/effort:/status:/area:` taxonomy the rest of this repository uses. It now asks for `type:deps`. Landing on `main` rather than riding a release: Dependabot version updates stopped running here at the end of June, and they only re-register when the config file itself changes on the default branch — measured across the org, confirmed on `Glyndor/apt#65`. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
The org standardised on MIT as its single license, so helmly-agent moves off Apache-2.0 as part of the org-wide migration. - `LICENSE` — canonical MIT text, `Copyright (c) 2026 Glyndor`. - `README.md` — the License section. - `NOTICE` — removed. It is an Apache-2.0 §4(d) mechanism; MIT does not use one, so keeping it would just be a file nobody can act on. No SPDX headers in source, and `Cargo.toml` carries no `license` field to update. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Jaro-c
added
type:chore
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bringing develop to main so the license and the Dependabot config are the ones on the default branch. No tag, no release — this is a branch sync.
Why it matters beyond tidiness: Dependabot reads its config from the default branch, and its registration only comes back when that file changes there. As long as main carries the old copy, this repository keeps getting no update pull requests at all.
What rides along: