66 lines
3.6 KiB
JSON
66 lines
3.6 KiB
JSON
{
|
|
"source_url": "https://codeberg.org/forgejo/forgejo/archive/v11.0.3.tar.gz",
|
|
"archive_sha256": "1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c",
|
|
"source_sha256": {
|
|
"modules/repository/hooks.go": "c7d149a66c2e1170e50b6f6bd9fd1c96cbfab68dfed3e664d503bfb05e4e1348",
|
|
"modules/git/repo.go": "947f588eb6d4f1c3557fe388372d12ea51122aef4806abdd1534502aa4b6e724",
|
|
"modules/git/git.go": "873adbca740394f9e46e4b77cc03793ccd1e7f9eb63662f71dd24038df384da4",
|
|
"modules/setting/git.go": "acf65899bf95cf2501056425bbdb91631f382b12abea85549ca192c2bc000851",
|
|
"services/repository/files/temp_repo.go": "692736146b03a7e43f9c582450f9990690bbb2f806d08b26335bbd005af5e964",
|
|
"services/pull/merge.go": "aa906907523fe65f2ea1c4e4ef2d2a8a1678dc5e36784ef35380670aaa1117c7",
|
|
"services/mirror/mirror_pull.go": "38e3db501b43254713eeabc85dff183fdc29ba3f3fc0bb1c963730e581361cc0",
|
|
"services/repository/migrate.go": "7814a7628ca258e1c2425f7ae65ffb7dd065a75d3f11c9ffbe13691ef7f3296a",
|
|
"routers/api/v1/repo/file.go": "a333f507f6f11f34cacd059e4dc2c3d16d1a34123df91145be1f3007d0bc907d",
|
|
"routers/api/v1/repo/pull.go": "27bf82e2d565e43e2e15c9c5a43630650bd4f40f55d9cf0a8f87809ac229b968"
|
|
},
|
|
"native_receipt": "forge-lifecycle-final.json",
|
|
"passed_boolean_checks": 23,
|
|
"failed_boolean_checks": 0,
|
|
"prior_attempts": [
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-1.json",
|
|
"result": "unverified",
|
|
"phase": "prepare"
|
|
},
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-2.json",
|
|
"result": "unverified",
|
|
"phase": "baseline"
|
|
},
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-3.json",
|
|
"result": "unverified",
|
|
"phase": "baseline"
|
|
},
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-4.json",
|
|
"result": "unverified",
|
|
"phase": "baseline"
|
|
},
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-5.json",
|
|
"result": "unverified",
|
|
"phase": "baseline"
|
|
},
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-6.json",
|
|
"result": "unverified",
|
|
"phase": "api-write"
|
|
},
|
|
{
|
|
"receipt": "forge-lifecycle-attempt-7.json",
|
|
"result": "unverified",
|
|
"phase": "pull-request"
|
|
}
|
|
],
|
|
"interpretation": {
|
|
"frontend_api": "Real content API and merge service accept clean inputs and refuse injected synthetic keys; actual detector receipt required, not HTTP refusal alone. API file refusal maps to HTTP 500; merge refusal maps to HTTP 409.",
|
|
"new_repository": "Default create omits additive scanner. A configured Git init.templateDir containing pre-receive.d/profile installs the exact profile on native auto-initialized repository creation.",
|
|
"lifecycle": "Native admin hook regeneration preserves additive hook; container restart preserves profiles and inherited detector still refuses synthetic API content.",
|
|
"production_limit": "No deployed configuration change, new production repository, production HTTP/SSO/UI acceptance or k3s restart performed. Templates remain a tested candidate, not production enforcement.",
|
|
"uncovered_paths": "Upstream import/mirror clone/fetch paths do not pass through receive-pack. A receive hook/template alone does not close imported or mirrored history, LFS, historical content, logs/artifacts, CI authority or response acceptance."
|
|
},
|
|
"earlier_success_ref": "forge-lifecycle-attempt-8.json",
|
|
"final_source_refinement": "Manifest-reuse correction after private classification of a public artifact checksum false positive; original admission digest retained, no suppression/bypass. Full lifecycle suite rerun after correction.",
|
|
"scanner_triage_ref": "scanner-triage.json"
|
|
}
|