[renovate]

This PR contains the following updates:

Package	Type	Update	Change
jdx/packslip	action	patch	v1.11.1 → v1.11.2

---

Release Notes

jdx/packslip

v1.11.2: : Detect replaced public keys that reuse the old key ID

Compare Source

packslip install now asks for approval when a key-signed project switches to a different public key that keeps the old key ID. This release also puts limits on how much work a hostile bundle can force the verifiers to do, and fixes two argument-handling gaps in the GitHub Actions. The format and specification are unchanged.

Fixed

• packslip install treats a replacement public key with the same key ID as a trust change. A minisign key ID is eight bytes of text in the public key file. It is not derived from the key itself. Before this release, the continuity check compared only that ID, so a different key with the old ID was accepted through --pubkey or pins.d without approval, and install then remembered the new key. Each key-signed record now also stores a fingerprint of the whole public key. A changed key is reported as public key changed from <old> to <new> and needs --accept-trust-change=<id> like any other trust change. That means one approval for the release list and one for the release, as the trust guide already described. Records for keyless projects are unchanged. (#​305, @​jdx)
  • Existing histories: On the first install after you upgrade, records without a fingerprint are filled in from the public key the history already remembers, so that install catches a same-ID replacement. If a history has a key-signed record but no remembered key, it adopts the first key it sees, as before. If an earlier version already accepted a same-ID replacement for the release list, the old key is lost and cannot be recovered. In that case the release check uses the replacement key as its baseline and does not catch the swap. Older packslip versions ignore the new field.
  • Pending approvals: If a key change was waiting for approval when you upgraded, its approval ID changes. Approve it again with the new ID.
• Verifiers reject oversized or malformed bundle data before doing expensive work. (#​304, @​jdx)
  • The standalone verifier (verifier/packslip-verify.mjs) rejects inclusion proofs whose logIndex or treeSize is not a non-negative int64. Before, a very long digit string took time that grew quadratically with its length. It also rejects checkpoints with more than 16 signatures.
  • The JavaScript package rejects bundles with more than 8 transparency-log entries or RFC 3161 timestamps before passing them to sigstore, which compares them pairwise before authenticating any. A normal release bundle has one entry.
  • In the Go library, Statement.Validate now finds artifacts with the same selectors in linear time. Before, the check was quadratic in the number of artifacts.
• GitHub Actions handle unusual artifact names and tags safely. (#​304, @​jdx)
  • The jdx/packslip action now passes -- before the artifact list. An artifact whose file name is exactly a packslip option, such as --no-pin-workflow, was previously read as that option. It is now treated as an artifact, and packslip create refuses it because it has no format.
  • The releases action now fails on a tag directory containing =. --release URL=PATH splits at the first =, so a tag like that moved part of the URL into the path.

Full Changelog: jdx/packslip@v1.11.1...v1.11.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.