Harden vendored-mode trust in patch-service artifacts - #249

Merged

Mikola Lysenko (mikolalysenko) merged 7 commits into

mainfrom

fix/vendor-service-integrity-hardening

Sep 24, 2026

Commits on Sep 23, 2026

fix(vendor): refresh the ledger fingerprint when a wired gem/maven/nuget artifact is rebuilt

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
d3e7ef0
fix(vendor): verify a served maven/nuget archive carries the patch before accepting it

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
32b73d5
fix(vendor): refuse a prebuilt artifact that fails integrity under auto too

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
8c37f5a
fix(vendor): refuse --vendor-source=service when no API client is configured

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
611c8bb
fix(vendor): route the cargo wired-copy rebuild through --vendor-source

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
c0581ac
fix(vendor): verify a served pypi wheel / npm tarball carries the patch

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
276c8a9
fix(vendor): only record a rebuilt entry over a same-uuid predecessor

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
032ab2b