feat: v5.0 Distribution & Trust (signed manifests, recovery scorecard, GitHub Action, GHCR) - #34
Merged
Merged
Conversation
feat: v5.0 Distribution & Trust — signed manifests, recovery scorecard, Action, GHCR Trust & verification: - Ed25519 signed manifests (src/lib/manifest-signing.js): BACKUP_SIGNING_KEY signs manifest.json -> manifest.json.sig; restore verifies with BACKUP_SIGNING_PUBLIC_KEY (BACKUP_REQUIRE_SIGNATURE aborts on missing/invalid). Fingerprint in summary. - Recovery scorecard (src/lib/recovery-scorecard.js): monthly restore drill publishes docs/recovery-scorecard.json (status + RTO) -> README endpoint badge + dashboard tile. - Tamper-evident audit log: entries hash-chained (prev + hash) with verifyChain(). Distribution: - GitHub Action wrapper (action.yml) — uses: OmarRao/github-gdrive-backup@v5; JSON summary output. - GHCR publish workflow (publish.yml) — image on release with SBOM + signed provenance. UI/docs: - Dashboard System Health adds Restore Verified + Manifest Signature tiles (demo + live). - README Trust/Action/GHCR sections + badges; USERGUIDE 15C; CHANGELOG 5.0.0; SUPPORT.md; new trust-distribution.svg; .env.example signing vars; SW cache v6. Security: documented open extract-zip advisory (GHSA-jmr9-qjv8-65gv, no fix available) in DEPENDENCY-LICENSE-REVIEW.md with mitigation + planned replacement. QA: 97/97 tests pass (16 new), lint clean, SPDX headers present, all workflow YAML + action.yml valid, dashboard verified in browser (0 console errors). Version 5.0.0. @
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v5.0 — Distribution & Trust. Makes recoverability and integrity provable and packages the tool for one-line adoption.
Trust & verification
BACKUP_SIGNING_KEYsignsmanifest.json→manifest.json.sig; restore verifies withBACKUP_SIGNING_PUBLIC_KEY(BACKUP_REQUIRE_SIGNATURE=trueaborts on missing/invalid). Catches tampering/forgery, not just corruption.docs/recovery-scorecard.json(status + RTO) → Restore Verified README badge + dashboard tile.verifyChain().Distribution
action.yml) —uses: OmarRao/github-gdrive-backup@v5, no fork needed; emits a JSONsummary.publish.yml) — container image on each release with SBOM + signed provenance.UI / docs
trust-distribution.svg,.env.examplesigning vars.Security note
Documented an open
extract-zipadvisory (GHSA-jmr9-qjv8-65gv, no fix available) inDEPENDENCY-LICENSE-REVIEW.mdwith mitigation (own-storage-only, signed manifests) and a planned replacement. Not remediated in this PR because the swap needs a new package + restore-path validation, and installs were network-blocked during this change.QA
97/97 tests pass (16 new: signing, scorecard, audit chain), ESLint clean, SPDX headers present, all workflow YAML +
action.ymlvalid, dashboard verified in-browser (0 console errors).No co-authors. Version bumped to 5.0.0.