T

Admin 77bd21aea2 M2 §5: pin auth attestation into InstalledMetadata and inject AUTH_PINNED_FINGERPRINT

Fetch the auth service's key attestation over mTLS at install time and
persist the fingerprint (plus kid/issued-at) in the install record. At
start, inject AUTH_PINNED_FINGERPRINT into every non-oneoff service so
the shared authclient refuses a substituted key instead of silently
trusting it (TOFU/D3). Best-effort: installs that cannot reach the auth
service backfill the pin on the next start. Skip pinning for the auth
service itself (it is the attester).

2026-08-15 23:43:02 +01:00

.gitea/workflows

fix: Tighten license autocommit bot to PRs, implement .licenseignore for ignoring specific files or directories

2026-08-04 23:34:46 +01:00

.vscode

real init

2026-07-29 01:36:09 +01:00

src

M2 §5: pin auth attestation into InstalledMetadata and inject AUTH_PINNED_FINGERPRINT

2026-08-15 23:43:02 +01:00

.dockerignore

real init