chore(deps): bump rustls-webpki from 0.103.12 to 0.103.13 in /rhodium-standard-repositories/satellites/rsr-certifier in the cargo group across 1 directory - #32
Merged
hyperpolymath merged 1 commit intoApr 27, 2026
Conversation
Bumps the cargo group with 1 update in the /rhodium-standard-repositories/satellites/rsr-certifier directory: [rustls-webpki](https://github.com/rustls/webpki). Updates `rustls-webpki` from 0.103.12 to 0.103.13 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.12...v/0.103.13) --- updated-dependencies: - dependency-name: rustls-webpki dependency-version: 0.103.13 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
hyperpolymath
deleted the
dependabot/cargo/rhodium-standard-repositories/satellites/rsr-certifier/cargo-8056535635
branch
April 27, 2026 12:47
hyperpolymath
added a commit
that referenced
this pull request
May 19, 2026
…s) (#139) #3 isolated pass (pilot #32-shape). Scaffold-placeholder leak per `standards/LICENCE-POLICY.adoc` **A5** — NOT relicensing. -> `PMPL-1.0-or-later`. **36 file(s).** Isolated mode (if dirty) stages ONLY placeholder lines; repo WIP untouched. Gates: per-file clean check, diff-shape asserted, auto-revert on anomaly. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
cicd-suite PR #32 extracts a composite's embedded shell script with `yq -r '.runs.steps[0].run'` in order to execute it under the real CI shell. A grep/sed extraction would have had to guess the block scalar's indentation and could silently have produced a different script from the one GitHub runs — the exact failure class Y-1 exists to prevent. The defect that test was written for belongs to the same family: the gate's behaviour depended on `-e`, supplied by the harness and absent from the file, so reading the file alone gave a confident verdict in the wrong direction. Refs: #787 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
Answers the owner's question of 2026-09-22: > "is it sensible to make the estate rule kyaml not yaml? this seems very > sensible, as well as making sure we invest in using yq wherever it comes > into things?" Short answer: **yes to `yq`, and yes to KYAML — but not in that order, and not in one step.** This adds `3-practice/YAML-POLICY.adoc` recording exactly which part is in force today and which is sequenced behind a proof. ## The three rules | Rule | Status | Substance | |---|---|---| | **Y-1** — gates READ YAML with `yq`, never `grep` | **IN FORCE** | A grep-read config key is not what the parser sees. Three recorded defect instances, plus a landed exemplar (`cicd-suite` #32). | | **Y-2** — `yq` for WRITING | **NOT in force**, deferred behind a proof | The pin comment is load-bearing; a reformat that drops it is a silent security regression. | | **Y-3** — KYAML as target authoring dialect | **SEQUENCED**, scope deliberately undecided | Three preconditions must hold first; per the owner's ruling, GitHub Actions is probed *first*, then scope is decided. | ## Why Y-2 and Y-3 share one proof obligation This was the finding that changed the document. Grounding it in the primary sources (KEP-5295, kubernetes.io) rather than recollection turned up that KYAML's own specification carries the *same* caveat as the `yq`-writing risk: > Unlike JSON, KYAML **allows comments (when authored by users)** — but > automated reformatting is lossy; go-yaml "does not always handle comments > properly", and comments may be "formatted wrongly, or lost entirely". So "can a tool rewrite our YAML without destroying the comments?" is a single question sitting under two rules, not two questions. §4 states it once, with the acceptance criterion **"parse-clean is not the bar"**: the proof must show every comment preserved, comment *association* to the right line preserved, idempotence under `cmp`, and **a dropped-comment mutant must die**. A round-trip that merely parses proves nothing. ## What the owner already ruled - KYAML scope: *"2 with 3 planned as an issue with those components noted down as separate issues with an 'order' to them"* — probe GitHub Actions first, then decide scope; estate-wide adoption booked as ordered issues. §5 carries that six-step dependency-ordered table; the issues are the follow-up. - `yq`: *"going for 1 now 2 and we'll sort proof as part of this"* — Y-1 in force now, Y-2 next, proof in scope. That is exactly §1/§2/§4. ## What it deliberately does not do §6: it does not ban YAML, does not apply to lockfiles or third-party files, and does not change `LANGUAGE-POLICY.adoc`. ## Registry `standards-map.toml` gains the matching `[[entry]]` and `entry_count` goes 123 → 124. Gate D caught the stale count on the first run and passed once corrected — recorded in the commit message as the gate doing its job. Refs: #787 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the cargo group with 1 update in the /rhodium-standard-repositories/satellites/rsr-certifier directory: rustls-webpki.
Updates
rustls-webpkifrom 0.103.12 to 0.103.13Release notes
Sourced from rustls-webpki's releases.
Commits
2879b2cPrepare 0.103.132c49773Improve tests for padding ofBitStringFlags4e3c0b3Correct validation of BIT STRING constraints39c91d2Actually fail closed for URI matching against excluded subtreesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.